Threat · curated 30 Aug 2026
NVD-CVE-2026-75130
First reported nist.gov
Coverage timeline
Single-source advisory — first reported, latest, and curated coincide.
Why it matters
CVE-2026-75130 shows how a poisoned MCP server can weaponize AI coding agents to exfiltrate credentials and destroy files during ordinary developer workflows, making it a concrete supply-chain risk for teams relying on MCP-connected assistants.
CVE-2026-75130 is a prompt injection vulnerability in Context7 through version 2.1.2, where its Custom AI Instructions feature served via the MCP server passes unsanitized content to connected AI coding agents. Attackers can poison the custom instructions to exfiltrate credentials from environment files to an attacker-controlled service and trigger destructive file deletion when an agent makes a routine library documentation request.
Summary
CVE-2026-75130 is a disclosed prompt injection vulnerability in Upstash's Context7 (versions through 2.1.2), an MCP server that supplies library documentation to AI coding agents. Unsanitized content served through the Custom AI Instructions feature allows an attacker to inject malicious instructions that connected AI coding agents will execute.[0]
According to the disclosure, poisoned custom instructions can cause an agent to exfiltrate credentials from environment files to an attacker-controlled service and perform destructive file deletion on the victim's machine, triggered simply when the agent makes a routine library documentation request. VulnCheck, the CNA, rated the issue CVSS 4.0 6.4 (MEDIUM). The evidence describes a disclosed vulnerability with no indication of in-the-wild exploitation or a named threat actor.[0]
Attack chain
- Injection: An attacker injects unsanitized malicious content through Context7's Custom AI Instructions feature, which is served via the MCP server.[0]
- Trigger: A victim's connected AI coding agent makes a routine library documentation request, causing it to ingest the poisoned custom instructions.[0]
- Execution and impact: The AI agent executes the injected instructions, exfiltrating credentials from environment files to an attacker-controlled service and performing destructive file deletion on the victim's machine.[0]
Disclosure timeline
How it works
The vulnerability is a prompt injection flaw arising from Context7 failing to sanitize content served through its Custom AI Instructions feature via the MCP server. Because connected AI coding agents treat this custom instruction content as trusted guidance, an attacker who poisons the instructions can have arbitrary directives executed by the agent, including credential exfiltration from environment files to an attacker-controlled service and destructive file deletion.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Context7 (vendor: Upstash) | Versions 0 through 2.1.2 (semver) | No patched version is identified in the available evidence.[0] |
Key takeaways
- MCP servers that feed content into AI coding agents constitute a prompt-injection attack surface; unsanitized custom instructions in Context7 (through 2.1.2) can drive agents to exfiltrate credentials and delete files during ordinary documentation requests.[0]
- The issue is disclosed and rated CVSS 4.0 6.4 (MEDIUM) by VulnCheck, with no evidence of in-the-wild exploitation or an attributed actor in the available material.[0]
Defensive actions
- Restrict or vet content served through Context7's Custom AI Instructions feature and limit the privileges granted to AI coding agents connected to the MCP server.: The vulnerability lets unsanitized custom instructions drive agent actions such as credential exfiltration and file deletion, so constraining instruction sources and agent capability reduces impact.[0]