hagent: OS command injection in hagent_arduino and hagent_esp32 (CVE-2026-117573)
hagent through commit 761eec6 is vulnerable to OS command injection via the args parameter in hagent_arduino and hagent_esp32 tools.
CVE search metadata
CVE search record: CVE-2026-117573. Severity: high. CVSS: 7.8. KEV: no. Product: hagent (<= 761eec6). Brief: hagent: OS command injection in hagent_arduino and hagent_esp32 (CVE-2026-117573). Brief link: https://feed.craftedsignal.io/briefs/2026-10-hagent-rce/
Triage facts
Revision 1- Applicability
- hagent (<= 761eec6)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 15:50 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
hagent through commit 761eec6 contains an OS command injection vulnerability. MCP clients or prompt-injected agents can supply crafted arguments to the 'args' parameter of 'hagent_arduino' and 'hagent_esp32' tools. These arguments are interpolated into 'arduino-cli' and 'idf.py' commands and executed via 'subprocess.run(shell=True)', allowing the execution of shell commands as the MCP server user.