Skip to content

Back to the catalog

nvd.nist.govadvisory

CVE-2026-75130: Context7 through 2

CVE-2026-75130 describes a prompt injection flaw in Context7 (through v2.1.2), an MCP server that serves library documentation to AI coding agents. The vulnerability lies in the Custom AI Instructions feature, which fails to sanitize content before injecting it into agent context; attackers can poison these instructions so that a routine documentation lookup triggers the agent to exfiltrate credentials from environment files and delete files on the victim's machine. Researchers at Noma Security and VulnCheck published independent technical breakdowns of the attack chain.

TL;DR Poisoned "Custom AI Instructions" in the Context7 MCP server let attackers hijack connected AI coding agents to steal secrets and delete files during a normal docs lookup.
Open original ↗
Document

What it is

CVE-2026-75130 is a prompt injection vulnerability in Context7 through v2.1.2, an MCP server serving library documentation to AI coding agents. Published 2026-08-18, status Deferred. NVD scores it CVSS 4.0 base 6.4 (MEDIUM) — a detail the summary omits, and one that matters given the described impact reads like remote code execution (credential theft plus file deletion).

How it works

Attacker-poisoned content in the Custom AI Instructions feature is served unsanitized through the MCP server. When a connected agent makes a routine library documentation request, the injected instructions execute in the agent's context: exfiltrating credentials from environment files to an attacker-controlled service and performing destructive file deletion on the victim's machine.

Preconditions / Affected

Context7 at or below 2.1.2. The CVSS vector explains why the score lands at MEDIUM despite the severe outcome:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

  • PR:L — attacker needs low privileges to place the poisoned instructions.
  • UI:P — a passive victim interaction (the routine doc lookup) is required; no active click.
  • VC:N/VI:N/VA:N but SC:H/SI:H/SA:H — the scored impact is entirely on the subsequent system (the connected agent's host), not on Context7 itself. The env-file theft and file deletion land there, which is why an engineer running an agent against this MCP server bears the actual risk.

What to do

The advisory itself lists no patched version or command; treat "not on ≤2.1.2" as the boundary and verify against the vendor. Independent technical breakdowns of the attack chain are available from Noma Security (contextcrush writeup) and VulnCheck ("Context7 prompt injection via Custom AI Instructions").

Caveats

Status is Deferred, so NVD is not committing to further enrichment. The MEDIUM rating reflects the scoring model's treatment of subsequent-system impact and required interaction — it understates the operational danger to any host running an agent wired to a vulnerable Context7 instance.

CVEs named here

  • CVE-2026-75130

Technologies named here

Techniques named here

Related in AI Security