CVE-2026-117573

HighCVSS 7.8/10Last modified Nov 2, 2026

Description

hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated into arduino-cli and idf.py commands run with subprocess.run(shell=True) to execute commands as the MCP server user.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
masc-ucsc	hagent	<= 761eec627a1e6fb128a2a8ce9245aa595cc2f7af

References

Timeline

Published: Oct 27, 2026
Last modified: Nov 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1175749.1A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request s CVE-2026-1175884.3The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active Google Places configura CVE-2026-11769.8A security flaw has been discovered in itsourcecode School Management System 1.0. Affected is an unknown function of the file /subject/index CVE-2026-1176017.5Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to r CVE-2026-1176028.4Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module whe CVE-2026-1176034.3Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to CVE-2026-1176047.5Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated v CVE-2026-1176054.3nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellPro CVE-2026-1176065.4NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' regist CVE-2026-1176077.2Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission t CVE-2026-1176086.1Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table CVE-2026-1176097.1rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-