https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T13:24:01.944461+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-262147 EUVD-2026-262147 2026-10-07T13:24:01.997528+00:00 EUVD-2026-262147 https://cve.radiocsirt.org/vuln/fkie_cve-2025-35028 fkie_cve-2025-35028 2026-10-07T13:24:01.997568+00:00

By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s normal privilege; typically, this is root. There is no attempt to sanitize these arguments in the default configuration of this MCP server at the affected version (as of commit 2f3a5512 in September of 2025).

 https://cve.radiocsirt.org/vuln/ghsa-2j8m-rmq4-rcw5 GHSA-2j8m-rmq4-rcw5 2026-10-07T13:24:01.997614+00:00

By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s normal privilege; typically, this is root. There is no attempt to sanitize these arguments in the default configuration of this MCP server at the affected version (as of commit 2f3a5512 in September of 2025).