Description

A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function run_task of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The pull request to fix this issue awaits acceptance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-14T03:16:37.083Z",
  "pubdate": "2026-09-14T03:16:37.083Z",
  "executiveSummary": "A critical OS command injection vulnerability exists within the MCP HTTP Server component of GH05TCREW PentestAgent, affecting all versions up to commit cf882dabea3ed91cef016cdd115e5426315665a2.\nThe vulnerability originates from the insecure handling of input within the run_task function, allowing an unauthenticated remote attacker to execute arbitrary system commands on the host machine with the privileges of the application process.\nGiven that this software utilizes a rolling release strategy, all current deployments should be considered potentially vulnerable.\nThe risk is critical due to the triviality of remote exploitation and the potential for full system compromise, data exfiltration, or lateral movement within the network.\nThe vulnerability is currently public, significantly increasing the probability of active exploitation by threat actors.",
  "technicalDetails": "The vulnerability resides in the interface/main.py file of the MCP HTTP Server component, specifically within the run_task function. The root cause of this vulnerability is the improper sanitization and validation of user-supplied input before it is passed to a system-level execution interface.\nThe application architecture fails to isolate user-controlled data from internal command execution logic, allowing an attacker to inject shell metacharacters such as ';', '|', '&&', or '`'. By crafting a malicious payload within a request handled by the MCP HTTP Server, an attacker can manipulate the command string intended for execution, thereby appending or replacing it with arbitrary operating system commands.\nThe attack flow proceeds as follows: 1) The attacker identifies an entry point through the MCP HTTP Server that interfaces with the run_task function. 2) The attacker crafts a request containing a malicious payload designed to terminate the intended task command and inject a command of their choosing. 3) The application receives the request and processes the unsanitized input via the vulnerable run_task function. 4) The underlying OS executes the injected command with the process's effective user privileges. 5) The server potentially returns the output of the command back to the attacker, facilitating reconnaissance or further payload delivery.\nBecause the MCP HTTP Server is exposed to network traffic, this vulnerability does not require authentication or elevated local privileges, making it a highly accessible vector for remote code execution (RCE). The impact of successful exploitation is catastrophic, as it grants the attacker a foothold on the system, which can be leveraged to establish persistence, pivot into internal network segments, or perform full exfiltration of sensitive penetration testing data held within the PentestAgent environment."
}