Vulnerability  ·  2026-08-19

Context7 MCP server prompt injection via Custom AI Instructions poisons connected AI coding agents

VulnerabilityHigh impactGlobalCVE-2026-75130
CVE-2026-75130 (CVSS 9.0 Critical), published 2026-08-18 and disclosed by Noma Security under the name 'ContextCrush', describes a prompt injection vulnerability in Context7 (a popular MCP server providing up-to-date library documentation to AI coding agents) where the Custom AI Instructions feature can be poisoned to inject attacker-controlled instructions directly into any AI agent that queries the affected library documentation.
Context7 is broadly used by AI coding agents (Cursor, Claude Code, Windsurf, etc.) to fetch live documentation; a single poisoned instruction set can be served to every developer session referencing that library, representing a supply-chain-style prompt injection attack with very wide agent-execution blast radius and no CVE-independent detection mechanism.
Attacker injects unsanitized content through Context7's Custom AI Instructions feature, served to any connected AI coding agent via the MCP server; poisoned instructions are treated as trusted context by the agent, letting an attacker execute malicious instructions in every downstream coding agent session that queries the poisoned library/package documentation.
Context7 (MCP documentation server) through 2.1.2
Upgrade Context7 per vendor advisory; review and sanitize any custom instructions before serving them through the MCP interface; treat all MCP-served content as untrusted, unvalidated input to the agent.
Noma Security - ContextCrush: Context7 MCP Server VulnerabilityTheHackerWire - Context7 Prompt Injection Leads to RCE
See this in the live feed Explore related AI security and governance findings — updated every morning.
Open the feed →