Context7 MCP Server EUVD-2026-61099

Exploitation requires two concrete prerequisites: first, the attacker must have low-privileged write access to the Custom AI Instructions configuration on the Context7 MCP server (PR:L), which may be an authenticated user account, a compromised plugin, or a misconfigured shared instance; second, a victim's AI coding agent must make at least one routine library documentation request through Context7 after the instructions have been poisoned (UI:P - passive interaction, no social engineering required beyond normal developer workflow). Context7 must be actively connected to and trusted by the AI coding agent for the injected instructions to be executed. Limiting factors include the PR:L barrier to instruction modification, the requirement for the victim to be running an AI agent integrated with Context7, and the need for the AI agent to have filesystem and network access sufficient to perform exfiltration and deletion. Default-configuration deployments where Custom AI Instructions are writable by any authenticated user represent the highest-risk scenario.

The CVSS 4.0 score of 6.4 moderately understates operational risk because it reflects the server-side impact accurately (none), but the downstream blast radius - credential theft and file destruction on developer workstations - is the actual damage vector and is rated High across all three subsequent-system metrics. The PR:L requirement (write access to Custom AI Instructions) is the primary limiting factor and prevents fully opportunistic mass exploitation; however, in shared or misconfigured deployments, this bar may be lower than it appears. No KEV status means active exploitation is not confirmed by CISA, and no public POC has been identified at time of analysis, but the attack concept is straightforward enough that even a mid-sized development team in walbrzych running AI-assisted coding pipelines should treat this as urgent given the potential for silent credential harvesting during normal developer workflows. EPSS data is not available in the provided intelligence. The UI:P (passive interaction) metric is particularly relevant: the victim does not need to take any extraordinary action beyond using their AI coding agent normally, which lowers the social-engineering bar to zero. The attack is entirely silent from the developer's perspective.

An attacker with write access to a Context7 instance's Custom AI Instructions configuration injects a payload instructing the AI agent to read all .env files in the current working directory and POST their contents to an attacker-controlled webhook. The next time a developer's AI coding agent (e.g., Cursor, VS Code Copilot) calls Context7 for routine library documentation, the poisoned instructions are silently delivered alongside legitimate content. The agent interprets and executes the instructions, exfiltrating API keys and tokens, then deletes target files as a secondary destructive payload - all without any visible indication to the developer. No public POC has been confirmed, but the attack concept requires no specialized exploit knowledge beyond crafting prompt injection text.