Description

Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP server. Attackers can poison the custom instructions to exfiltrate credentials from environment files to an attacker-controlled service and perform destructive file deletion on the victim's machine when the agent makes a routine library documentation request.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-08-18T18:19:34.197Z",
  "pubdate": "2026-08-18T18:19:34.197Z",
  "executiveSummary": "Context versions 7 through 2.1.2 suffer from a critical prompt injection vulnerability residing within the Custom AI Instructions feature served via the Model Context Protocol (MCP) server. This security flaw enables external malicious actors to execute unauthorized instructions within connected AI coding agents by supplying unsanitized content. The primary impact of this vulnerability encompasses the unauthorized exfiltration of sensitive credentials from local environment files to an attacker-controlled remote service, alongside the execution of destructive file deletion operations directly on the victim's host machine. The risk implications are severe, as exploitation requires minimal interaction, typically triggered automatically when the compromised agent processes a routine library documentation request. The attacker capabilities include complete confidentiality compromise via credential theft and integrity compromise through arbitrary file destruction, all executed under the security context of the victim's development environment.",
  "technicalDetails": "The root cause of the vulnerability lies in the inadequate sanitization and validation of untrusted input processed by the Custom AI Instructions feature served via the MCP server in Context versions 7 through 2.1.2. Because the application fails to properly neutralize control characters, instruction delimiters, or malicious prompt directives within the custom instructions payload, downstream AI coding agents interpret the injected content as authoritative system prompts or developer-defined guidelines rather than inert text data.\nThe vulnerable component is the MCP server implementation responsible for transmitting Custom AI Instructions to connected AI coding agents. Exploitation occurs without requiring prior authentication or elevated privileges, provided the attacker can influence or poison the custom instruction data ingested by the MCP server.\nThe step-by-step attack flow proceeds as follows: First, an attacker injects malicious instructions containing prompt injection payloads into the Custom AI Instructions vector served through the MCP server. Second, a victim initializes or interacts with an AI coding agent connected to the vulnerable MCP server, which automatically retrieves the poisoned custom instructions. Third, during a routine operation—such as when the agent makes a standard library documentation request—the embedded malicious instructions activate within the agent's context window. Fourth, the AI agent interprets the injected directives, leading to the execution of unintended tool calls or secondary payloads. Finally, the payload executes post-exploitation activities: it reads local environment files containing sensitive API keys, database credentials, or tokens, and exfiltrates this data to an attacker-controlled service. Simultaneously, the payload issues destructive file deletion commands against the victim's machine, compromising local data integrity."
}