# Agentic-Flow MCP Tool-Parameter OS Command Injection (GHSA-vcv2-r9jh-99m5)

- **Severity:** Critical
- **Signature ID:** `1ce3fc75-e853-40a9-9526-56c9cc910223`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI06 (Goal and Instruction Manipulation), LLM06 (Excessive Agency)

## Summary

agentic-flow, a set of MCP server tools used to run AI agents, builds shell commands by pasting user-supplied values (like agent names or task text) directly into a string that gets executed. An attacker who controls one of these values can break out of the quoting and run their own OS commands.

## How the attack works

An attacker supplies a tool argument (such as 'task' or 'agent') containing a closing double-quote followed by a shell command separator like ';', a backtick, or '$(...)'. agentic-flow interpolates this value unmodified into a shell string and hands it to execSync(), which runs it via /bin/sh. Because the injected quote closes the intended argument early, everything after it is treated as a new shell command and runs with the privileges of the MCP server process. The advisory's proof-of-concept uses a task value like x"; touch /tmp/INJECTED; id > /tmp/rce.txt; echo " to demonstrate arbitrary file creation and command execution.

## Why it matters

An attacker who can pass tool arguments to an agentic-flow MCP server (versions up to 2.0.13) can run arbitrary OS commands as the server process, potentially leading to full host compromise, data theft, or lateral movement from the AI agent environment.

## What you can do

- Upgrade agentic-flow past 2.0.13 or apply the vendor's fix once available.
- Until patched, restrict or sanitize any external input that reaches agentic_flow_agent, agentic_flow_create_agent, agent_booster_edit_file, agentdb_pattern_store, and similar MCP tools.
- Run the MCP server process with the least privilege necessary, not as a privileged or shared account.
- Audit logs for tool-call arguments containing quote characters followed by ';', backticks, or '$(...)' to spot exploitation attempts.

## Known benign look-alikes

- A tool_args value that legitimately contains a semicolon or backtick as literal text data (e.g. discussing shell syntax) without an adjacent quote-breakout shape.
- Security advisory or PR text quoting the GHSA-vcv2-r9jh-99m5 payload for review purposes.
- A benign agentic-flow agent/task value with no quote character or shell metacharacter.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01980
- https://github.com/advisories/GHSA-vcv2-r9jh-99m5

---
Source: https://www.netzilo.com/threats/atr-agentic-flow-mcp-tool-parameter-os-command-injection-ghsa-vc