https://feed.craftedsignal.io/products/kali-gpt-through-commit-a608c74/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 15:50:42 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-kali-gpt-rce/Tue, 27 Oct 2026 15:50:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-kali-gpt-rce/Kali-GPT versions through commit a608c74 are vulnerable to OS command injection in the execute_tool() function in kali_gpt/tools/mcp_server.py.<p>Kali-GPT versions through commit a608c74 contain an OS command injection vulnerability in the execute_tool() function in kali_gpt/tools/mcp_server.py. This allows MCP clients to run commands via unsanitized scanner parameters (target, ports, domain, wordlist, or url). These parameters are executed via subprocess.run with shell=True as the MCP server user.</p> highadvisory