CVE-2026-19329

CVE-2026-19329 is a command injection vulnerability in the 'ask' MCP tool from the codex_mcp package. The flaw allows arbitrary command execution through the model parameter—the tool passes this parameter directly to a shell command without sanitization, which means any process that can send requests to the MCP server can achieve code execution. The CVSS 5.3 score is dangerously misleading. The 'local approach' qualifier in the vector assumes the attacker needs direct access to the machine running the MCP server. But MCP tools are designed to be invoked by AI assistants and IDEs—the attack surface isn't the local machine alone, it's every AI query that can pass crafted input through the MCP protocol. If an attacker can influence what a developer asks their AI assistant, they can trigger command execution without ever touching the developer's terminal. The AI assistant becomes the attack vector. Worse: the MCP server runs in your development environment with access to your git credentials, SSH agents, potentially VPN configurations, and whatever cloud contexts your IDE has loaded. This isn't just code execution—it's code execution with the developer's full trust chain baked in. There is no version information available for this package, which means you cannot audit whether your dependency trees or container base images have pulled a vulnerable version. The maintainer has not responded to the reported issue. Remove this tool from your environment immediately. Audit your MCP integrations for other unmaintained or abandoned tooling—the absence of versioning and security responsiveness is a reliable indicator of risk. The MCP ecosystem is in its early growth phase, and this pattern of convenience-over-security in developer tooling will repeat. Treat it as a systemic warning, not an isolated incident.

Reviewed through automated stages and approved by a human before publication.