What happened
A coordinated wave of GitHub Security Advisories (published 2026-10-27) documents OS command injection across roughly nine MCP tool servers. In each, an agent-callable tool parameter is interpolated into a shell command without shell-metacharacter neutralization, so MCP clients — including prompt-injected agents — can execute arbitrary commands. The vendors describe command-injection classes reachable by prompt injection (e.g. DroidMind's Device.run_shell allowlist bypass).
Why it matters
This is a systemic agent-execution attack class: MCP tool servers are the agent's hands, and most do not treat tool parameters as untrusted input. A prompt-injected agent or compromised tool return gains OS command execution on the machine running the MCP server — an attacker can pivot from a single malicious prompt to host command execution. The breadth (9+ servers in one day) signals a widespread authoring habit rather than an isolated bug.
Attack vector
The shared pattern: agent tool parameters interpolate directly into shell commands (execSync / run_shell / CLI flags) without neutralizing $(), backtick, or metacharacter substitution. Because untrusted content reaches these parameters via prompt injection, a malicious prompt or injected tool return can drive the agent to execute arbitrary shell commands with the MCP server's privileges.
Affected systems
CVE-2026-117558 (ai-sdlc ≤0.31.2), CVE-2026-117559 (DroidMind ≤0.4.0), CVE-2026-117560 (ATXP ≤1.0.0), CVE-2026-117561 (sf-mcp ≤1.3.2), CVE-2026-117567 (esp-mcp), CVE-2026-117568 (mcp-ffmpeg ≤1.0.5), CVE-2026-117569 (Kali-GPT), CVE-2026-117573 (hagent), CVE-2026-117570 (nmap-mcp) — all published 2026-10-27
Mitigation
Upgrade each listed MCP server to its patched release, disable shell-command execution on these tools, and enforce a strict allowlist that rejects metacharacters. Review agent prompts/tool-return trust boundaries and sandbox the MCP server process.