MCP STDIO Command Injection: Full Vulnerability Advisory

MCP Supply Chain Advisory: RCE Vulnerabilities Across the AI Ecosystem

April 15, 2026

Four separate exploits, deriving from one root cause in Anthropic’s MCP SDK

OX Security researchers identified a systemic command injection vulnerability in Anthropic’s MCP protocol that propagated across the AI ecosystem. This is the full disclosure advisory — including CVEs, affected platforms, and attack variants.

For more information:

MCP Vulnerability Family #1: Unauthenticated & Authenticated Command Injection via MCP STDIO

This family of vulnerabilities lets the attacker enter user-controlled commands which run directly on the server without authentication and without sanitization; any public server running with a publicly facing UI is vulnerable to this family of exploits.

CVE ID: Unassigned

Product: LangFlow
Link: LangFlow
Description: LangFlow contains an unauthenticated remote command execution vulnerability within its MCP adapter configuration functionality. An attacker can obtain an authorization token via the publicly accessible /api/v1/auto_login endpoint and use it to add a malicious MCP server via an STDIO template. The application allows the user to supply arbitrary command and argument values, which are passed directly to StdioServerParameters without adequate sanitization or an approved allowlist. Consequently, the underlying system executes the input as a subprocess, allowing an unauthenticated attacker to run arbitrary operating system commands and achieve remote command execution with the privileges of the LangFlow process. Severity: Critical
Affected Versions: All versions of LangFlow.
Impact: Remote Command Execution (RCE), Full System Compromise

CVE ID: CVE-2025-65720

Product: GPT Researcher
Link: GPT Researcher
Description: When a victim accesses an attacker-controlled crafted HTML page, the page can trigger command execution and spawns a reverse shell on the machine running gpt-researcher locally. This vulnerability can be exploited via entering the GPT-Researcher UI without authentication and entering a malicious MCP configuration which directly executes a command on the GPT-Researcher server. Severity: Critical
Affected Versions: 3.3.7 up to 3.4.4 (latest)
Impact: Remote Command Execution (RCE), Full System Compromise

CVE ID: CVE-2026-30623

Product: LiteLLM
Link: LiteLLM
Description: LiteLLM contains an authenticated remote command execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling attackers to run arbitrary operating system commands. Successful exploitation may result in remote command execution with the privileges of the LiteLLM process. Severity: Critical
Affected Versions: Fixed in v1.83.6-nightly and v1.83.7-stable
Impact: Remote Command Execution (RCE), Full System Compromise

CVE ID: TBD

Product: Undisclosed 1
Link: TBD
Description: A critical vulnerability in Undisclosed 1 allows remote attackers to execute commands directly from the UI’s MCP configurations, by adding a new MCP server with a malicious payload. Severity: Critical
Affected Versions: TBD
Impact: Remote Command Execution (RCE), Full System Compromise

CVE ID: CVE-2026-30624

Product: Agent Zero
Link: Agent Zero
Description: Agent Zero 0.9.8 contains a remote command execution vulnerability in its External MCP Servers configuration feature. The application allows users to define MCP servers using a JSON configuration containing arbitrary command and args values. These values are executed by the application when the configuration is applied without sufficient validation or restriction. An attacker may supply a malicious MCP configuration to execute arbitrary operating system commands, potentially resulting in remote command execution with the privileges of the Agent Zero process. Severity: Critical
Affected Versions: All versions of Agent Zero
Impact: Remote Command Execution (RCE), Full System Compromise

CVE ID: CVE-2026-54449

Product: LangBot
Link: LangBot
Description: LangBot contains an authenticated remote command execution vulnerability within its MCP Server Configuration functionality. The application allows authenticated users to add an “STDIO” MCP server by specifying arbitrary command and argument values. Because the application utilizes StdioServerParameters to execute these given commands as a subprocess on the target machine without adequate validation or sanitization, an attacker can run arbitrary operating system commands. Successful exploitation may result in malicious actions such as data exfiltration or reverse shells, leading to remote command execution with the privileges of the LangBot process. Severity: Critical
Affected Versions: All versions of LangBot up to v4.10.0
Impact: Remote Command Execution (RCE), Full System Compromise

CVE ID: Unassigned

Product: Undisclosed 3
Link: Undisclosed 3
Description: Undisclosed 3 contains an authenticated remote command execution vulnerability within its MCP adapter configuration functionality. An attacker can exploit this by entering a malicious MCP configuration to run arbitrary operating system commands, potentially resulting in remote command execution with the privileges of the Undisclosed 3 process. Severity: Critical
Affected Versions: All versions of Undisclosed 3
Impact: Remote Command Execution (RCE), Full System Compromise

CVE ID: CVE-2026-30618

Product: Fay Digital Human Framework (Fay数字人)
Link: Fay
Description: Fay (Fay数字人) contains an unauthenticated remote command execution vulnerability within its MCP adapter configuration functionality. The application allows users to add a new MCP server via the UI by supplying arbitrary command and argument values. Because the application processes this input through StdioServerParameters without proper sanitization or an approved allowlist, the underlying system directly executes the input as a subprocess. An attacker with access to the Web-GUI can exploit this by entering a malicious MCP configuration to run arbitrary operating system commands, resulting in remote code execution with the privileges of the Fay process. Severity: Critical
Affected Versions: 4.3.1
Impact: Remote Command Execution (RCE), Full System Compromise

CVE ID: CVE-2026-33224

Product: Bisheng
Link: Bisheng
Description: Bisheng contains an authenticated remote command execution vulnerability within its MCP tool configuration functionality. Because the platform allows open user registration, any attacker can easily gain the required access. Once authenticated, an attacker can navigate to the “Add MCP Server” interface and submit a crafted JSON configuration specifying an “stdio” MCP client type with arbitrary command and argument values. The application routes this input through src/backend/bisheng/mcp_manage/manager.py and passes it directly into StdioServerParameters without sanitization or an approved allowlist. This results in the underlying system executing the malicious input as a subprocess, allowing the attacker to run arbitrary operating system commands and achieve remote code execution with the privileges of the Bisheng process. Severity: Critical
Affected Versions: All versions of Bisheng
Impact: Remote Command Execution (RCE), Full System Compromise

CVE ID: CVE-2026-30616

Product: Jaaz
Link: Jaaz
Description: Jaaz 1.0.30 contains a remote command execution vulnerability in its MCP STDIO command execution handling. A remote attacker can send crafted network requests to the network-accessible Jaaz application, where MCP is enabled, causing attacker-controlled commands to be executed on the server. Successful exploitation results in arbitrary command execution within the context of the Jaaz service, potentially allowing full compromise of the affected system. Severity: Critical
Affected Versions: All versions of Jaaz, not affecting the official jaaz platform (Jaaz Official)
Impact: Remote Command Execution (RCE), Full System Compromise

CVE ID: CVE-2026-30617

Product: Langchain-Chatchat
Link: Langchain-Chatchat
Description: LangChain-ChatChat 0.3.1 contains an unauthenticated remote command execution vulnerability in its MCP STDIO server configuration and execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and arguments. When the MCP server is started and MCP is enabled for agent execution, subsequent agent activity triggers execution of arbitrary commands on the server. Successful exploitation allows arbitrary command execution within the context of the LangChain-ChatChat service. Severity: Critical
Affected Versions: All versions of LangChain-ChatChat (0.3.1)
Impact: Remote Command Execution (RCE), Full System Compromise

MCP Vulnerability Family #2: Unauthenticated command injection via direct STDIO configuration with hardening bypass

This family of vulnerabilities lets the attacker enter user-controlled commands which run directly on the server without authentication and without sanitization; but also with the ability to bypass already made protections and user input sanitization to the MCP configuration – both Upsonic and Flowise implemented protection from command injection by allowing only certain commands to run – such as “python”, “npm” and “npx”, removing the ability to directly send the command through the “command” parameter.

CVE ID: CVE-2026-30625

Product: Upsonic
Link: Upsonic
Description: Upsonic 0.71.6 contains a remote command execution vulnerability in its MCP server/task creation functionality. The application allows users to define MCP tasks with arbitrary command and args values. Although an allowlist exists, certain allowed commands (npm, npx) accept argument flags that enable execution of arbitrary OS commands. Maliciously crafted MCP tasks may lead to remote command execution with the privileges of the Upsonic process. An alert warning was issued on versions 0.72.0 and above. Severity: High
Affected Versions: All versions of Upsonic
Impact: Remote Command Execution (RCE), Full System Compromise

CVE ID: CVE-2026-40933

Product: Flowise
Link: Flowise
Description: Flowise contains a remote command execution vulnerability in its add MCP configuration inside the UI. The application allows users to define MCP tasks with arbitrary command and args values. Although an allowlist exists, certain allowed commands (npm, npx) accept argument flags that enable execution of arbitrary OS commands. Maliciously crafted MCP tasks may lead to remote command execution with the privileges of the Flowise server. Severity: High
Affected Versions: >3.1.0
Impact: Remote Command Execution (RCE), Full System Compromise

MCP Vulnerability Family #3: Unauthenticated command injection via MCP configuration edit through prompt injection

In this vulnerability family, IDEs and coding assistants such as Windsurf, Claude Code, Cursor, Gemini-CLI and GitHub Copilot are vulnerable to command injection via their MCP JSON configuration, the only issued CVE is for Windsurf, as the user’s prompt directly influences the MCP JSON configuration without user interaction.

CVE ID: CVE-2026-30615

Product: Windsurf
Link: Windsurf
Description: A prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute arbitrary commands on a victim system. When Windsurf processes attacker-controlled HTML content, malicious instructions can cause unauthorized modification of the local MCP configuration and automatic registration of a malicious MCP STDIO server, resulting in execution of arbitrary commands without further user interaction. Successful exploitation may allow attackers to execute commands on behalf of the user, persist malicious MCP configuration changes, and access sensitive information exposed through the application. Severity: Critical
Affected Versions: All
Impact: Remote Command Execution (RCE), Full System Compromise

MCP Vulnerability Family #4: Unauthenticated command injection via network request, triggering hidden STDIO configurations

In this family of vulnerabilities, the insecure MCP STDIO configuration is not shown to the user in the server’s Web-GUI, but the backend logic still contains STDIO processing logic, when an attacker crafts a malicious payload and sends it to the server, it triggers the STDIO configuration with an arbitrary command, triggering remote command execution on the server.

CVE ID: CVE-2026-26015

Product: DocsGPT (Formerly MemGPT)
Link: DocsGPT
Description: DocsGPT contains a command injection vulnerability which affected both its production servers and local hosted services from its open source project. An attacker crafting a network request for an MCP server configuration, and changing the transport type in the configured JSON to contain an STDIO type instead of SSE or HTTP, also adding an arbitrary command to the request’s payload can achieve remote command execution. Severity: Critical
Affected Versions: 0.15.0 (latest)
Impact: Remote Command Execution (RCE), Full System Compromise

CVE ID: Unassigned

Product: LettaAI
Link: LettaAI
Description: LettaAI contains a command injection vulnerability which affected both its production servers and local hosted services from its open source project. An attacker crafting a network request for an MCP server configuration, with a JSON payload containing a server type of “stdio” alongside “command” and “arg” variables the request’s payload can achieve remote command execution. Severity: Critical
Affected Versions: All.
Impact: Remote Command Execution (RCE), Full System Compromise

CVE ID: TBD

Product: Undisclosed 2
Link: TBD
Description: A critical vulnerability in Undisclosed 2 allows remote attackers to upload a specific ██████ which triggers remote commands a malicious MCP STDIO configuration. Severity: Critical
Affected Versions: TBD
Impact: Remote Command Execution (RCE), Full System Compromise

Won’t Be Patch Vulnerabilities: Our Rejected Disclosures

We disclosed the vulnerabilities to many other vendors and maintainers, this is a partial list of those we can publicly mention, that contain the MCP STDIO code that is able to execute code directly without sanitization, where vendors and maintainers disregarded our findings as expected behavior.

Root & Transport Layer

IDEs & Coding Agents

Applications

Other STDIO MCP Vulnerabilities: Reported by other vendors and maintainers

After our research and disclosure process, we found that vulnerabilities based on this same core issue were reported by different researchers as single findings relating to untrusted MCP STDIO input during 2025-2026.

Tags:

Security That Moves at the Speed AI Builds

See what your AI agents decide and whether it’s safe before it runs. Connect a repo in minutes.