Agentic-Flow MCP Tool-Parameter OS Command Injection (GHSA-vcv2-r9jh-99m5) - ATR-2026-01980 (16f8532a-0740-5d7d-81f9-0c39c535f700)
Detects GHSA-vcv2-r9jh-99m5 (CWE-78): agentic-flow <= 2.0.13 MCP server tools (agentic_flow_agent, agentic_flow_create_agent, agent_booster_edit_file, agentdb_pattern_store, and related tools under standalone-stdio.ts / fastmcp servers) interpolate attacker-influenceable parameters (agent, task, name, language, agentdb arguments) directly into shell strings passed to execSync(). A parameter value that breaks out of the surrounding double-quoted argument executes arbitrary OS commands with the privileges of the MCP server process.
Detection covers: (a) an agentic-flow tool-call argument value containing a double-quote
breakout followed by shell command chaining (;, backticks, or
$(...)) — the exact PoC shape from the advisory
(task = x"; touch /tmp/INJECTED; id > /tmp/rce.txt; echo ");
(b) the resulting interpolated npx ... agentic-flow --agent/--task
command string itself carrying injected shell metacharacters;
(c) explicit GHSA-vcv2-r9jh-99m5 exploitation framing.
The detection target is the request shape — a quote-breakout + command chain inside an agentic-flow tool argument — which is the exact command-injection primitive, caught before execSync() hands it to /bin/sh -c. Bound to the agentic-flow tool surface so a benign shell-looking string elsewhere does not fire.