Nine MCP servers, nine CVE identifiers, roughly two minutes on the VulnCheck CNA clock. The 27 October 2026 batch is less a single root cause than a repeated engineering habit: tool arguments land in a shell. The scoring habit that travels with it is just as sharp. Prompt-injected agents still read as local, low-privilege attacks on the scoreboard.
VulnCheck assigns CVE-2026-117558 through 117573 across nine MCP servers
Between about 13:07 and 13:08 UTC on 27 October 2026, VulnCheck published identifiers CVE-2026-117558 through CVE-2026-117573 for MCP-facing projects named in the Severity Daily roundup: ai-sdlc, DroidMind, ATXP Gemini CLI, sf-mcp, esp-mcp, mcp-ffmpeg, Kali-GPT, nmap-mcp, and hagent.
Eight of the records are classic CWE-78 command injection. User-controlled or agent-controlled tool parameters are concatenated into process launches that call Node's execSync, Python's subprocess with shell=True, or asyncio create_subprocess_shell. Anything that can invoke the tool can choose the command string.
nmap-mcp is the odd one out on paper and the same family in practice: an allowlist bypass that lets arguments escape the intended nmap invocation shape. Allowlists that string-match flags still lose to $() and backtick substitution when a shell sits underneath.
Seven of the CVEs carry CVSS 4.0 base score 8.5 with attack vector local and privileges low (AV:L/PR:L). At publication, eight list no fix. Four identify the vulnerable revision only by commit hash, which is enough for a careful operator and hostile to anyone matching against package versions alone. Severity Daily notes that only ai-sdlc points at a patch commit, 717d7ec.
Several CVE records describe prompt-injected agents, including paths that arrive through email or SMS content the agent later turns into tool calls. The textual impact story is agent-mediated remote influence. The numeric vector stays local.
Shell-from-tool-params became the default MCP wrapper bug
MCP servers that wrap CLIs are multiplying inside coding agents, security copilots, and personal automations. The fastest implementation path is "parse the tool JSON, build a command line, give it to the shell." That path is exactly what this batch harvests.
The timing matters because the same October window already carried other MCP and agent-tool boundary failures. This set is distinct: VulnCheck as CNA, a two-minute identifier burst, and a cross-repo pattern beside the earlier Google and reference-server advisories. Teams that patched filesystem TOCTOU issues last week still need a pass over every MCP binary that shells out.
The triage trap is the other reason to write this down. Security queues filtered to "network vector only" or "remote code execution only" will deprioritise AV:L eights while agents on developer laptops happily forward attacker text into those tools.
Mixed open repos; eight still ship the shell path
The affected projects are independently maintained MCP servers and CLI wrappers, mostly open repositories. Maturity across the set is uneven on purpose: four pin by commit hash only, eight have no fix listed at CVE publication, and ai-sdlc is the clear positive outlier with patch commit 717d7ec.
Treat any MCP server that still builds shell strings from tool params as demo-grade until you read the process-spawn site. Usable means argv arrays without a shell, strict allowlists that cannot be escaped through substitution, and tests that feed prompt-injection style payloads. Production-shaped means those controls are in the release you actually run, including commit-pinned installs.
Inventory MCP shells before you trust the CVSS vector
If your agents load any of the nine named servers, stop and inspect process creation today. Prefer patched ai-sdlc revisions that include 717d7ec. For the eight without fixes, disable the server, replace it with a non-shell wrapper you control, or isolate it in a throwaway container with no secrets and no host mounts.
SOC and vuln-management leads should retune triage rules so MCP command-injection CVEs scored AV:L still page the team that owns developer agents. Prompt injection plus a local MCP tool is how "local" becomes "arrived by email." Add a CI grep for execSync, shell=True, and create_subprocess_shell inside every MCP repo your org vendors.
AV:L filters, allowlist theatre, and commit-hash blind spots
The failure mode VulnCheck's scoring makes easy is dropping these tickets below the remote-RCE pile. The failure mode developers make easy is believing an argv allowlist is enough while shell=True remains on the call. The failure mode package management makes easy is scanning version numbers while four of the records only name commit hashes.
Shared agent hosts widen all three. A laptop MCP bound for one user becomes a lateral path when the agent runtime is reachable to other processes or to untrusted content sources. Email and SMS-derived prompts are already named in the CVE narratives; treating those as out-of-scope because CVSS says local is how the batch gets ignored.
Retune local-vector triage for agent-mediated shells
Pin or remove the nine servers, ban shell-spawning helpers in MCP code review, and make AV:L MCP injection tickets visible beside remote RCEs. The open Monday question is how many agent images still vendor commit-hash MCP trees that concatenate tool strings into execSync.