Prompt Injection Vulnerability in Context7

Context7, an AI-powered coding tool, contains a critical prompt injection vulnerability (CVE-2026-75130) affecting versions up to and including 2.1.2. The vulnerability exists within the Model Context Protocol (MCP) server implementation of the Custom AI Instructions feature. By injecting unsanitized content into these instructions, an unauthorized actor can force connected AI coding agents to execute arbitrary instructions. This capability allows the agent to be manipulated into exfiltrating sensitive credentials stored in local environment files to an external, attacker-controlled service. Furthermore, the vulnerability enables the agent to perform destructive file operations, such as arbitrary file deletion, during standard operations like library documentation requests. Because the agent executes these commands within the security context of the user's host environment, the risk of data compromise and system disruption is significant for developers relying on Context7 for automated coding tasks.

Impact

The vulnerability poses a high risk to software development environments, as it allows attackers to bypass security boundaries of AI coding agents. Successful exploitation can lead to the loss of sensitive environment variables, including API keys and authentication tokens, and the deletion of project files. This threat impacts individual developers and organizations integrating Context7 into their CI/CD or local development workflows.

Recommendation

Prioritize the upgrade of all Context7 installations to a version beyond 2.1.2 immediately. Monitor outbound network traffic from developer workstations and CI/CD runners for anomalous connections to unauthorized external hosts, specifically from processes associated with AI coding agent runtimes. Implement strict egress filtering to prevent unauthorized data exfiltration from development environments. Review local environment configuration files to ensure that overly permissive secrets are not stored in plain text where an AI agent could reach them.