CVE-2026-58195: ruvnet agentic-flow OS command injection in MCP server tools

CVE-2026-58195 · Severity: high · CVSS 8.8 · Published 2026-07-17

Vendors: npm.

Executive brief

Agentic-Flow is a platform used to coordinate and manage AI agents. A security flaw in its Model Context Protocol (MCP) server tools allows an attacker to execute unauthorized commands on the underlying server. This could lead to a complete system takeover, theft of sensitive data, or disruption of AI operations, especially if the platform processes untrusted content from the web.

Technical details

The vulnerability is a CWE-78 (OS Command Injection) resulting from the use of `execSync()` with template literals containing attacker-controlled parameters (e.g., agent, task, name, language). Affected components include various MCP server implementations such as `standalone-stdio.ts`, `claude-flow-sdk.ts`, and several tools in the `fastmcp` subtree. An attacker can break out of the intended command string using shell metacharacters (like `;`, `&`, or backticks) to execute arbitrary OS commands. The issue is particularly severe in HTTP/SSE transport deployments that lack authentication or origin validation. The fix, introduced in version 2.0.14, replaces `execSync` with `execFileSync` using `shell: false` to ensure arguments are passed as a literal array to the OS without shell interpretation.

Affected products

ruvnet agentic-flow < 2.0.14

Timeline

2026-06-18: patched: Fix commit merged into main branch
2026-07-17: disclosed: CVE-2026-58195 published

References

Related threats

ruvnet agentic-flow OS command injection in MCP server tools