Kali-GPT: OS command injection via execute_tool() (CVE-2026-117569)
Kali-GPT versions through commit a608c74 are vulnerable to OS command injection in the execute_tool() function in kali_gpt/tools/mcp_server.py.
CVE search metadata
CVE search record: CVE-2026-117569. Severity: high. CVSS: 7.8. KEV: no. Product: Kali-GPT through commit a608c74. Brief: Kali-GPT: OS command injection via execute_tool() (CVE-2026-117569). Brief link: https://feed.craftedsignal.io/briefs/2026-10-kali-gpt-rce/
Triage facts
Revision 1- Applicability
- Kali-GPT through commit a608c74
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 15:50 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Kali-GPT versions through commit a608c74 contain an OS command injection vulnerability in the execute_tool() function in kali_gpt/tools/mcp_server.py. This allows MCP clients to run commands via unsanitized scanner parameters (target, ports, domain, wordlist, or url). These parameters are executed via subprocess.run with shell=True as the MCP server user.