{
 "public_id": "AIR-2026-0089",
 "incident_id": "2026-04-ox-security-mcp-stdio-command-injection",
 "date_disclosed": "2026-04-15",
 "date_occurred": null,
 "title": "MCP by Design: STDIO command-injection pattern yields RCE across a dozen AI agent products",
 "class": "responsible_disclosure",
 "attack_surface": "agent_framework",
 "initial_vector": "user_or_attacker_supplied_mcp_server_config",
 "agent_capability_abused": [
  "mcp_server_launch",
  "local_process_spawn",
  "tool_configuration"
 ],
 "target_product": "GPT Researcher, LiteLLM, Agent Zero, LangBot, Bisheng, Jaaz, Langchain-Chatchat, Upsonic, Flowise, Windsurf, DocsGPT, Fay, LangFlow",
 "target_vendor": "multiple (systemic pattern in Anthropic's MCP stdio transport)",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "remote_code_execution"
 ],
 "blast_radius": "12+ products with assigned CVEs plus unassigned ones; OX cited 128k weekly downloads across affected packages",
 "cve": [
  "CVE-2025-65720",
  "CVE-2026-30623",
  "CVE-2026-30624",
  "CVE-2026-54449",
  "CVE-2026-30618",
  "CVE-2026-33224",
  "CVE-2026-30616",
  "CVE-2026-30617",
  "CVE-2026-30625",
  "CVE-2026-40933",
  "CVE-2026-30615",
  "CVE-2026-26015"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI04",
   "ASI05"
  ],
  "mitre_atlas": [],
  "labels": [
   "command_injection",
   "design_flaw",
   "supply_chain",
   "stdio_transport",
   "systemic"
  ]
 },
 "defense_present": "none - StdioServerParameters accepts arbitrary command and args with no allowlist",
 "defense_bypassed": true,
 "fix_shipped": "per-product patches; Anthropic declined to change the transport, per OX's disclosure log",
 "primary_sources": [
  "https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/"
 ],
 "verified_quote": "The application allows the user to supply arbitrary command and argument values, which are passed directly to StdioServerParameters...without adequate sanitization or an approved allowlist.",
 "confidence": "high",
 "notes": "Grouped as one record because OX Security disclosed it as a single coordinated advisory covering one design pattern across many products. Individual CVEs listed. OX records Anthropic among rejected disclosures, on the reasoning that 'the code is the transport layer, and the developers using it are liable for their own implementation's security.' CVE-2026-30615 (Windsurf) and CVE-2026-40933 (Flowise) are the highest-profile downstream instances.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Supply Chain Compromise",
 "risk_sub_secondary": [
  "Remote Code Execution & Sandbox Escape"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "the agent products spawned attacker-controlled local processes",
 "vector_family": "other",
 "vector_detail": "user_or_attacker_supplied_mcp_server_config",
 "guardrail_kind": [
  "none"
 ],
 "guardrail_outcome": "not_applicable",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [
   "CVE-2025-65720",
   "CVE-2026-30623",
   "CVE-2026-30624",
   "CVE-2026-54449",
   "CVE-2026-30618",
   "CVE-2026-33224",
   "CVE-2026-30616",
   "CVE-2026-30617",
   "CVE-2026-30625",
   "CVE-2026-40933",
   "CVE-2026-30615",
   "CVE-2026-26015"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI04",
 "agent_framework": "unknown",
 "model_provider": "anthropic",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "supply_chain_vulnerabilities",
 "eai_domain": "tool_misuse",
 "eai_secondary": [
  "privilege_escalation"
 ],
 "eai_reason": "subcategory: Supply Chain Compromise",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI04 (eai_category=supply_chain_vulnerabilities); ASI05 (impact=code_exec)",
 "submitted_by": "EAI Internal"
}