Disclosed vulnerability
MCP by Design: STDIO command-injection pattern yields RCE across a dozen AI agent products
AIR-2026-0089 AIR record · 2026-04-ox-security-mcp-stdio-command-injection
From the supporting source
The application allows the user to supply arbitrary command and argument values, which are passed directly to StdioServerParameters...without adequate sanitization or an approved allowlist.ox.security
The record
Disclosed
2026-04-15
Vendor
multiple (systemic pattern in Anthropic's MCP stdio transport)
Product
GPT Researcher, LiteLLM, Agent Zero, LangBot, Bisheng, Jaaz, Langchain-Chatchat, Upsonic, Flowise, Windsurf, DocsGPT, Fay, LangFlow
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Privilege escalation
System type
Generative model
Who acted
Agent acted (contested) — the agent products spawned attacker-controlled local processes
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
User or attacker supplied mcp server config
Impact type
Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
12+ products with assigned CVEs plus unassigned ones; OX cited 128k weekly downloads across affected packages
Capability abused
Defense & remediation
Recorded defense
none - StdioServerParameters accepts arbitrary command and args with no allowlist
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
per-product patches; Anthropic declined to change the transport, per OX's disclosure log
Taxonomy & references
Curator notes
Grouped as one record because OX Security disclosed it as a single coordinated advisory covering one design pattern across many products. Individual CVEs listed. OX records Anthropic among rejected disclosures, on the reasoning that 'the code is the transport layer, and the developers using it are liable for their own implementation's security.' CVE-2026-30615 (Windsurf) and CVE-2026-40933 (Flowise) are the highest-profile downstream instances.
Supporting sources
Cite as
Enkrypt AI. "MCP by Design: STDIO command-injection pattern yields RCE across a dozen AI agent products". AIR, AIR-2026-0089. https://agentincident.vercel.app/i/AIR-2026-0089/ (accessed 2026-10-19).