Summary
hagent contains an OS command injection vulnerability in the hagent_arduino and hagent_esp32 tools, where MCP-supplied arguments are incorporated into shell commands without adequate neutralization. An MCP client or prompt-injected agent may cause commands to run with the privileges of the hagent MCP server when crafted argument values reach the affected execution paths.
hagent contains an OS command injection vulnerability in the hagent_arduino and hagent_esp32 tools, where MCP-supplied arguments are incorporated into shell commands without adequate neutralization. An MCP client or prompt-injected agent may cause commands to run with the privileges of the hagent MCP server when crafted argument values reach the affected execution paths.
Affected context
The issue occurs in hagent deployments that expose the affected Arduino or ESP32 MCP tools and pass their args values into arduino-cli or idf.py command execution. Risk depends on whether an MCP client or an agent influenced by untrusted content can invoke these tools and whether the server process has access to sensitive files, credentials, devices, or other system resources.
The issue occurs in hagent deployments that expose the affected Arduino or ESP32 MCP tools and pass their args values into arduino-cli or idf.py command execution. Risk depends on whether an MCP client or an agent influenced by untrusted content can invoke these tools and whether the server process has access to sensitive files, credentials, devices, or other system resources.
Exploit preconditions
- Attack surface: MCP tool interfaces for
hagent_arduinoandhagent_esp32 - Required access: The ability to invoke the affected tools or influence an agent that can invoke them
- Trigger point: Processing the tools'
argsparameter before subprocess execution - Why exploitation is possible: User-controlled argument data is interpolated into shell commands executed with
shell=True, allowing shell metacharacters to alter command interpretation
- Attack surface: MCP tool interfaces for
hagent_arduinoandhagent_esp32 - Required access: The ability to invoke the affected tools or influence an agent that can invoke them
- Trigger point: Processing the tools'
argsparameter before subprocess execution - Why exploitation is possible: User-controlled argument data is interpolated into shell commands executed with
shell=True, allowing shell metacharacters to alter command interpretation
Why this happens
The vulnerability results from constructing shell commands with externally influenced argument values and passing them to subprocess.run(shell=True).
This pattern causes data intended as command arguments to be interpreted as shell syntax. It maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, because input is not kept separate from executable command structure.
The vulnerability results from constructing shell commands with externally influenced argument values and passing them to subprocess.run(shell=True).
This pattern causes data intended as command arguments to be interpreted as shell syntax. It maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, because input is not kept separate from executable command structure.
Potential impact
- Execution of arbitrary commands as the hagent MCP server user
- Access to files, environment variables, tokens, or source code available to that account
- Modification of firmware projects, build artifacts, or local configuration
- Installation of additional tooling or persistence within the runtime environment
- Lateral movement or broader compromise where excessive permissions are available
- Execution of arbitrary commands as the hagent MCP server user
- Access to files, environment variables, tokens, or source code available to that account
- Modification of firmware projects, build artifacts, or local configuration
- Installation of additional tooling or persistence within the runtime environment
- Lateral movement or broader compromise where excessive permissions are available
General mitigation guidance
Mitigation generally focuses on eliminating shell interpretation and reducing trust in tool arguments.
Common defensive patterns include:
- Invoke subprocesses with argument arrays and shell execution disabled
- Apply strict allowlists and type validation to tool parameters
- Keep user-controlled values separate from command and option structure
- Use secure-by-default tool interfaces that expose only required build operations
- Run the MCP server with a dedicated least-privilege account and restricted filesystem access
- Limit credentials, device permissions, network access, and environment exposure available to the process
- Treat model-generated or prompt-derived tool arguments as untrusted input
Mitigation generally focuses on eliminating shell interpretation and reducing trust in tool arguments.
Common defensive patterns include:
- Invoke subprocesses with argument arrays and shell execution disabled
- Apply strict allowlists and type validation to tool parameters
- Keep user-controlled values separate from command and option structure
- Use secure-by-default tool interfaces that expose only required build operations
- Run the MCP server with a dedicated least-privilege account and restricted filesystem access
- Limit credentials, device permissions, network access, and environment exposure available to the process
- Treat model-generated or prompt-derived tool arguments as untrusted input
How teams detect issues like this
Detection can focus on:
- Static analysis rules identifying
shell=Truecombined with interpolated or concatenated input - Searches for subprocess calls that construct commands through f-strings, formatting, or string concatenation
- Code review checks for MCP tool parameters flowing into command execution without validation
- Runtime monitoring for unexpected child processes, shell interpreters, or command-line changes
- Policy enforcement that blocks shell-enabled subprocess APIs in services handling external or agent-generated input
- Automated security review tools that flag command construction and untrusted data-flow paths
Detection can focus on:
- Static analysis rules identifying
shell=Truecombined with interpolated or concatenated input - Searches for subprocess calls that construct commands through f-strings, formatting, or string concatenation
- Code review checks for MCP tool parameters flowing into command execution without validation
- Runtime monitoring for unexpected child processes, shell interpreters, or command-line changes
- Policy enforcement that blocks shell-enabled subprocess APIs in services handling external or agent-generated input
- Automated security review tools that flag command construction and untrusted data-flow paths
