CVE-2025-35028

CRITICAL 9.1CVE-2025-35028 · Published 30/11/2025 · updated 18/10/2026

In short

CVE-2025-35028 is a CRITICAL (CVSS 9.1) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 5.5%, higher than 92.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s normal privilege; typically, this is root. There is no attempt to sanitize these arguments in the default configuration of this MCP server at the affected version (as of commit 2f3a5512 in September of 2025).

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free