CVE-2026-117569

Kali-GPT MCP scanner arguments permit host command injection

alishahid74 · Kali-GPT MCP server

First documented disclosure · Review checkpoint

Summary

Crafted scanner parameters could run additional commands on the operator's machine.

Severity and exploitation evidence

High · 8.5/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources describe a vulnerability and demonstration, not established malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The MCP execute_tool path interpolates parameters into subprocess calls with shell execution enabled.

Conditions required

Control of an exposed MCP tool invocation in the operator's environment.

Potential impact

Command execution as the MCP server user; elevated privileges are not assumed.

Affected versions and configurations

Through commit a608c74e99910232dd208fee99de860458672b82.

Fix and mitigation status

No fixed version established in the reviewed sources.

Practical next steps

Disable affected MCP tools until patched; use explicit process arguments and least-privilege execution.

Operating lesson

Safety prompts in an interactive interface do not automatically protect an alternate tool interface.

Evidence and limits

The unchanged October 23 disclosure predates October 27 CVE publication. Prompt injection is a possible delivery path, not evidence of an observed campaign.

Sources