esp-mcp vulnerabilities

CVEs whose affected-version data names the esp-mcp package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-117567High· 7.8

yesterday

esp-mcp through commit 28afddf OS Command Injection via MCP Tool Parameters

esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt…

▾ Twilighthorw · esp-mcpvia CVEORG