Vulnerability · Published Nov 30, 2025 · Assigned by AHA

CVE-2025-35028HexStrike AI MCP Server Command Injection

Critical 9.1

In plain English

A critical-severity OS command injection in HexStrike AI from 0x4m4. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.5% (higher than 93% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)5.5%top 7.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s normal privilege; typically, this is root. There is no attempt to sanitize these arguments in the default configuration of this MCP server at the affected version (as of commit 2f3a5512 in September of 2025).

Affected products (as reported)

Vendor	Product	Versions
0x4m4	HexStrike AI	33267047667b9accfbf0fdac1c1c7ff12f3a5512

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://takeonme.org/gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000000111111111111111111111111000000000000000000000000000000000000000000000000000000011 third-party-advisory, technical-description, exploit
https://github.com/0x4m4/hexstrike-ai/issues/115 issue-tracking