hagent EUVD-2026-110849

The exploit requires the attacker to be able to invoke the hagent_arduino or hagent_esp32 MCP tools and control their args parameter - either as an MCP client connected to the hagent MCP server or as a prompt-injected agent driving that client. No non-default configuration is needed beyond running the hagent MCP server (through commit 761eec6) exposing these build tools; the shell=True interpolation of args into arduino-cli/idf.py is the always-present trigger. Limiting factors: the attack is local-vector (AV:L), requires the privilege level of an MCP client that can reach these tools (PR:L), and is bounded to code execution as the MCP server user rather than automatic privilege escalation; it is therefore reachable only where the hagent MCP server is deployed and its Arduino/ESP32 tools are exposed to the caller.

Signals are moderately consistent and point to a real but bounded priority. The CVSS 4.0 base score of 8.5 reflects full compromise of the vulnerable system (VC:H/VI:H/VA:H) via a low-complexity attack (AC:L/AT:N) requiring only low privileges and no user interaction, but the attack vector is LOCAL (AV:L), which sharply limits mass remote exploitation - this is not an internet-wide, unauthenticated RCE. The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with a serious issue that is not under active mass exploitation. There is NO CISA KEV listing (not actively exploited per CISA) and NO EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The references include a VulnCheck advisory and GitHub issue #98 documenting the flaw, plus direct links to the vulnerable source lines (mcp_arduino.py#L776, mcp_esp32.py#L682), so the mechanism is well evidenced even though no verified working exploit artifact is confirmed. The distinctive risk modifier is the prompt-injection angle: because the hagent_arduino/hagent_esp32 MCP tools interpolate caller-supplied args into shell commands, a prompt-injected LLM agent - not just a human attacker - can trigger code execution, which raises practical exposure in agentic deployments beyond what AV:L alone suggests. Net: a genuine high-severity local/agent-reachable RCE in a niche research tool, worth prompt remediation but not an emergency given the local vector, absent KEV, and tiny deployment footprint.

An attacker or prompt-injected agent that can invoke the hagent MCP server's hagent_arduino or hagent_esp32 tools supplies an args value containing shell metacharacters (e.g. appended with ';' or '$(...)'). Because the args string is interpolated into arduino-cli or idf.py commands executed via subprocess.run(shell=True), the injected commands run as the MCP server user. A public PoC reference exists (VulnCheck advisory and GitHub issue #98); it is not verified as working exploit code.