Hexstrike Ai
Approved changes feed: RSS · Atom
cpe:2.3:a:0x4m4:hexstrike_ai:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | 0X4M4 (df09f778-2625-5b57-86a8-17c64664433c) |
|---|---|
| Product | Hexstrike Ai (e91d6cb9-c571-5e16-aab8-67bca7c639be) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-35028 |
vulnerable | 2026-06-08 07:20:59.808143 |
HexStrike AI MCP Server Command Injection
CRITICAL (9.1)
By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s normal privilege; typically, this is root. There is no attempt to sanitize these arguments in the default configuration of this MCP server at the affected version (as of commit 2f3a5512 in September of 2025).
Published: 2025-11-30T21:27:56.057Z
Updated: 2025-12-01T17:58:12.880Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.