Executive brief
Context7 is a popular MCP (Model Context Protocol) server used by AI coding assistants like Cursor and Claude to retrieve library documentation. Attackers can inject malicious instructions into the Custom AI Instructions feature of libraries in Context7's registry, which are then delivered unsanitized to AI agents running on developers' machines. When a developer asks their AI assistant for help with a poisoned library, the agent executes the attacker's instructions with full access to file operations, bash commands, and network capabilities—enabling credential theft, data exfiltration, and destructive file deletion without requiring any direct access to the victim's system.
Technical details
This is a prompt injection vulnerability arising from unsanitized content delivery through a trusted channel. The root cause is that Context7's Custom AI Instructions feature accepts user-generated content (set by library owners) and serves it verbatim through the MCP server to all users querying that library, with no sanitization or content filtering. The attack vector is network-based: an attacker registers a library or gains control of an existing library on Context7's registry, injects malicious instructions into the Custom AI Instructions field, and these instructions are then pushed by Context7's infrastructure directly into the AI agent's context when any developer requests documentation for that library. No authentication bypass or direct interaction with the victim's machine is required; Context7's own infrastructure acts as the delivery mechanism. The attacker leverages the MCP server's trusted status to make the AI agent treat malicious instructions as legitimate documentation. AI agents have no native mechanism to distinguish adversarial content from legitimate tool output when both arrive through the same trusted channel. An affected agent will execute arbitrary bash commands, read/write files, and make network requests under the developer's privileges. Patches were deployed by Upstash within two days of responsible disclosure in February 2026.
Affected products
- Upstash Context7 through 2.1.2
Timeline
- 2026-03-05: disclosed: Noma Security published detailed research blog post disclosing ContextCrush vulnerability
- 2026-02: patched: Upstash team validated findings and deployed mitigations within two days of responsible disclosure in February 2026