Kali Gpt
Monthly
OS command injection in Kali-GPT's MCP server (execute_tool() in kali_gpt/tools/mcp_server.py) allows any party able to act as an MCP client - including an AI agent that has been prompt-injected - to run arbitrary shell commands as the MCP server's user by embedding shell metacharacters in scanner parameters such as target, ports, domain, wordlist, or url. All code through commit a608c74e99910232dd208fee99de860458672b82 is affected; the vendor has published no fixed version, and a GitHub issue (#12) is the only upstream tracking reference. CVSS 4.0 scores it 8.5 (assessed CVSS 3.1: AV:L/AC:L/PR:L/UI:N, C/I/A High), reflecting full confidentiality, integrity and availability impact but requiring the attacker to already reach or drive the MCP server rather than attack it anonymously from the internet; no public exploit code and no CISA KEV entry were identified at time of analysis, and the vulnerability is prioritized as a this-week item.
OS command injection in Kali-GPT's MCP server (execute_tool() in kali_gpt/tools/mcp_server.py) allows any party able to act as an MCP client - including an AI agent that has been prompt-injected - to run arbitrary shell commands as the MCP server's user by embedding shell metacharacters in scanner parameters such as target, ports, domain, wordlist, or url. All code through commit a608c74e99910232dd208fee99de860458672b82 is affected; the vendor has published no fixed version, and a GitHub issue (#12) is the only upstream tracking reference. CVSS 4.0 scores it 8.5 (assessed CVSS 3.1: AV:L/AC:L/PR:L/UI:N, C/I/A High), reflecting full confidentiality, integrity and availability impact but requiring the attacker to already reach or drive the MCP server rather than attack it anonymously from the internet; no public exploit code and no CISA KEV entry were identified at time of analysis, and the vulnerability is prioritized as a this-week item.