OS Command Injection in Kali-GPT by Alishahid74

CVE-2026-117569

What is CVE-2026-117569?

The vulnerability in Kali-GPT arises from an OS command injection flaw in the execute_tool() function, located in the mcp_server.py file. This issue allows attackers to exploit unsanitized scanner parameters—such as target, ports, domain, wordlist, or URL—permitted by the MCP server user. By embedding shell metacharacters into these parameters, attackers or prompt-injected agents are able to execute arbitrary commands, leading to potential unauthorized access or control of the system.

References