Junglewise Threat Intelligence

ruvnet agentic-flow OS command injection in MCP server tools

Severity: high · CVSS 8.8 · Published 2026-06-19

Vendors: npm.

Executive brief

Agentic-Flow is a framework used to build and manage AI agents. A security flaw in its server tools allows an attacker to execute unauthorized commands on the host system by providing specially crafted input to the AI agent. This could lead to a total system takeover, data theft, or disruption of services, especially in deployments that process untrusted web content or files.

Technical details

The vulnerability is a CWE-78 (OS Command Injection) resulting from the direct interpolation of attacker-controlled parameters (such as 'agent', 'task', and 'language') into shell command strings passed to Node.js 'execSync()'. Because these parameters are not properly sanitized, an attacker can use shell metacharacters (e.g., semicolons or double quotes) to break out of the intended command and execute arbitrary code with the privileges of the MCP server process. The attack can be triggered remotely if the agent processes untrusted data from web pages or third-party tools. The issue was addressed in version 2.0.14 by migrating from 'execSync' to 'execFileSync', which avoids shell interpretation of arguments.

Affected products

  • ruvnet agentic-flow <= 2.0.13
  • ruvnet ruflo < 3.12.4
  • ruvnet claude-flow < 3.12.4

Timeline

  • 2026-06-18: disclosed: Reported by hackchang via red-team report package.
  • 2026-06-18: patched: Fixed in agentic-flow version 2.0.14.
  • 2026-06-19: advisory: GitHub Advisory GHSA-vcv2-r9jh-99m5 published.

References

Related threats