Summary
Kali-GPT contains an OS command injection vulnerability in the MCP server's tool execution path, where scanner parameters are incorporated into shell commands without sufficient sanitization. An attacker or prompt-injected agent able to submit MCP tool requests may execute arbitrary operating-system commands with the privileges of the MCP server process.
Kali-GPT contains an OS command injection vulnerability in the MCP server's tool execution path, where scanner parameters are incorporated into shell commands without sufficient sanitization. An attacker or prompt-injected agent able to submit MCP tool requests may execute arbitrary operating-system commands with the privileges of the MCP server process.
Affected context
The issue occurs in Kali-GPT deployments that expose the MCP server and allow clients or agents to invoke scanner-related tools. It becomes risky when parameters such as targets, ports, domains, wordlists, or URLs can be influenced by an untrusted client, external content, or prompt injection and are subsequently passed to a shell-enabled subprocess.
The issue occurs in Kali-GPT deployments that expose the MCP server and allow clients or agents to invoke scanner-related tools. It becomes risky when parameters such as targets, ports, domains, wordlists, or URLs can be influenced by an untrusted client, external content, or prompt injection and are subsequently passed to a shell-enabled subprocess.
Exploit preconditions
- Attack surface: MCP tool requests reaching the server's execute_tool()
function
- Required access: Ability to invoke relevant MCP tools or influence an agent
that can invoke them
- Trigger point: Processing scanner parameters and launching the associated
subprocess
- Why exploitation is possible: Untrusted parameter values can reach a shell
command through subprocess execution with shell=True
- Attack surface: MCP tool requests reaching the server's execute_tool()
function
- Required access: Ability to invoke relevant MCP tools or influence an agent
that can invoke them
- Trigger point: Processing scanner parameters and launching the associated
subprocess
- Why exploitation is possible: Untrusted parameter values can reach a shell
command through subprocess execution with shell=True
Why this happens
The vulnerability results from constructing or executing shell commands with attacker-influenced parameters while enabling shell interpretation. Shell metacharacters and command syntax are therefore treated as executable operators rather than ordinary data. This is CWE-78, OS Command Injection, caused by insufficient separation between data supplied to a process and the command interpreter responsible for executing it.
The vulnerability results from constructing or executing shell commands with attacker-influenced parameters while enabling shell interpretation. Shell metacharacters and command syntax are therefore treated as executable operators rather than ordinary data. This is CWE-78, OS Command Injection, caused by insufficient separation between data supplied to a process and the command interpreter responsible for executing it.
Potential impact
- An attacker may execute arbitrary commands as the MCP server user.
- The vulnerable process may be used to access local files or environment data.
- Attackers could alter application state, tools, or generated scan results.
- The server may be used as a foothold for lateral movement, depending on its
permissions and network access.
- Prompt-injected agents could unintentionally trigger command execution.
- An attacker may execute arbitrary commands as the MCP server user.
- The vulnerable process may be used to access local files or environment data.
- Attackers could alter application state, tools, or generated scan results.
- The server may be used as a foothold for lateral movement, depending on its
permissions and network access.
- Prompt-injected agents could unintentionally trigger command execution.
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from tool execution and reducing trust in client-controlled parameters. Prefer direct process APIs that pass arguments as separate values, use strict allowlists and type-aware validation for targets and scanner options, and reject unexpected characters or structures where appropriate. Avoid accepting arbitrary executable arguments, isolate scanner operations, apply least-privilege identities and filesystem permissions, and limit outbound network access. Treat model output and MCP client input as untrusted even when requests originate from an apparently trusted workflow.
Mitigation generally focuses on removing shell interpretation from tool execution and reducing trust in client-controlled parameters. Prefer direct process APIs that pass arguments as separate values, use strict allowlists and type-aware validation for targets and scanner options, and reject unexpected characters or structures where appropriate. Avoid accepting arbitrary executable arguments, isolate scanner operations, apply least-privilege identities and filesystem permissions, and limit outbound network access. Treat model output and MCP client input as untrusted even when requests originate from an apparently trusted workflow.
How teams detect issues like this
Detection can include static analysis rules for subprocess calls using shell=True, string concatenation or interpolation in command construction, and tool parameters flowing into process execution without validation. Code reviews should examine every MCP tool boundary, identify parameters that influence commands, and verify that direct argument arrays are used. Runtime monitoring can alert on unexpected child processes, shell interpreters, unusual command-line arguments, and tool requests from untrusted sources. CI policies and automated security review tools can help flag these patterns before deployment.
Detection can include static analysis rules for subprocess calls using shell=True, string concatenation or interpolation in command construction, and tool parameters flowing into process execution without validation. Code reviews should examine every MCP tool boundary, identify parameters that influence commands, and verify that direct argument arrays are used. Runtime monitoring can alert on unexpected child processes, shell interpreters, unusual command-line arguments, and tool requests from untrusted sources. CI policies and automated security review tools can help flag these patterns before deployment.
