What happened
CVE-2026-75130 (CVSS 9.0 Critical), published 2026-08-18 and disclosed by Noma Security under the name 'ContextCrush', describes a prompt injection vulnerability in Context7 (a popular MCP server providing up-to-date library documentation to AI coding agents) where the Custom AI Instructions feature can be poisoned to inject attacker-controlled instructions directly into any AI agent that queries the affected library documentation.
Why it matters
Context7 is broadly used by AI coding agents (Cursor, Claude Code, Windsurf, etc.) to fetch live documentation; a single poisoned instruction set can be served to every developer session referencing that library, representing a supply-chain-style prompt injection attack with very wide agent-execution blast radius and no CVE-independent detection mechanism.
Attack vector
Attacker injects unsanitized content through Context7's Custom AI Instructions feature, served to any connected AI coding agent via the MCP server; poisoned instructions are treated as trusted context by the agent, letting an attacker execute malicious instructions in every downstream coding agent session that queries the poisoned library/package documentation.
Affected systems
Context7 (MCP documentation server) through 2.1.2
Mitigation
Upgrade Context7 per vendor advisory; review and sanitize any custom instructions before serving them through the MCP interface; treat all MCP-served content as untrusted, unvalidated input to the agent.