CVE-2026-58195 Details
Description
Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts, src/mcp/fastmcp/servers/http-sse.ts, src/mcp/fastmcp/servers/poc-stdio.ts, src/mcp/fastmcp/tools/agent/{execute,list,parallel}.ts, src/mcp/fastmcp/tools/swarm/orchestrate.ts, and src/mcp/fastmcp/tools/hooks/pretrain.ts interpolated attacker-influenceable tool parameters such as agent, task, name, language, and agentdb directly into shell command strings passed to execSync(), allowing arbitrary OS command execution with the privileges of the MCP server user. This issue is fixed in version 2.0.14.
A command injection vulnerability has been identified in the Agentic-Flow orchestration platform, specifically in MCP server tools prior to version 2.0.14. The issue arises from the interpolation of attacker-controlled tool parameters directly into shell command strings, which are then executed using execSync(). This flaw allows arbitrary operating system commands to be executed with the privileges of the user running the MCP server. The vulnerability is particularly concerning in deployments where untrusted content is processed by the AI agent, as it can be exploited without direct access to the host.
Users can upgrade to Agentic-Flow version 2.0.14 or later, which addresses the vulnerability by replacing execSync() with execFileSync() in the affected MCP server tools. After updating Agentic-Flow, users on an existing [email protected] install can pull the patched dependency manually.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ruvnet/agentic-flow/security/advisories/GHSA-vcv2-r9jh-99m5 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/ruvnet/agentic-flow/commit/0c2ec967736a8b6b85832c6bae2a3e74989705ec | [email protected] | Source CodeVendor |
| https://github.com/ruvnet/agentic-flow/issues/169 | [email protected] | AdvisoryIssue TrackingRemedyVendor |
| https://github.com/ruvnet/agentic-flow/pull/170 | [email protected] | Issue TrackingVendor |
| https://github.com/ruvnet/agentic-flow/security/advisories/GHSA-vcv2-r9jh-99m5 | [email protected] | AdvisoryExploitRemedyVendor |
| https://github.com/ruvnet/ruflo/issues/2414 | [email protected] | Issue TrackingRemedyVendor |
| https://github.com/ruvnet/ruflo/pull/2415 | [email protected] | Issue TrackingVendor |
| https://github.com/ruvnet/ruflo/releases/tag/v3.12.4 | [email protected] | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ruvnet agentic-flow | <= 2.0.13 (semver) |
CPE
Remediation
| |
| ruvnet ruflo | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |