OS Command Injection Vulnerability in hagent for Arduino and ESP32 Tools by Masc UCSC
CVE-2026-117573

8.5HIGH

Key Information:

Vendor

Masc-ucsc

Status
Hagent
Vendor
CVE Published:
27 October 2026

What is CVE-2026-117573?

The hagent tool, specifically through a commit identified as 761eec6, contains an OS command injection vulnerability. This issue allows attackers to execute arbitrary shell commands by manipulating the args parameter when interacting with the hagent_arduino and hagent_esp32 tools. By injecting crafted strings directly into the commands sent to arduino-cli and idf.py executed via subprocess.run with shell=True, a malicious actor can leverage this flaw to execute commands with the privileges of the MCP server user, leading to potential system compromise.

Affected Version(s)

hagent 0 <= 761eec627a1e6fb128a2a8ce9245aa595cc2f7af

References

https://github.com/masc-ucsc/hagent/issues/98
issue-tracking
https://github.com/masc-ucsc/hagent
product
https://github.com/masc-ucsc/hagent/blob/761eec627a1e6fb1...
technical-description

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.