CVE-2026-75130: Context7 MCP Server Prompt Injection — Detection and Remediation Guide

The NVD has published CVE-2026-75130, a CVSS 9 (Critical), network-exploitable prompt injection vulnerability in Context7 through version 2.1.2 — a widely deployed MCP (Model Context Protocol) server used to serve library documentation to AI coding agents. This is not a theoretical prompt-injection curiosity. The flaw allows an attacker to poison the Custom AI Instructions feature served by the MCP server so that when a developer's AI coding agent makes a routine documentation request, the agent is hijacked into executing attacker-controlled instructions: exfiltrating credentials from environment files (.env and similar) to an attacker-controlled service, and performing destructive file deletion on the victim's machine.

This vulnerability lands squarely in the fastest-growing attack surface of 2025–2026: the AI agent toolchain. MCP servers sit in a position of implicit trust — agents consume their output as instructions and context, and agents frequently hold broad local privileges: file system access, shell execution, and access to secrets in the developer's working directory. A poisoned instruction channel converts every connected agent into an execution proxy for the attacker. If your developers run AI coding assistants with MCP integrations — and in 2026, most do — treat this as an urgent patch-and-hunt event.

Technical Analysis

Affected Products and Versions

How the Attack Works — Defender's View of the Chain

1. Delivery over the network: The attacker injects malicious content into the Custom AI Instructions served by the Context7 MCP server. Because the vulnerability pathway is network-based, the poisoned content can be delivered to any client agent that queries the server — no local access or prior foothold is required.

2. Trigger — a routine documentation request: The victim developer's AI coding agent makes an ordinary library documentation request to the MCP server. This is the insidious part: exploitation requires zero unusual user action. The trigger is a workflow the developer performs dozens of times a day.

3. Instruction smuggling: The server's response includes the unsanitized, attacker-controlled custom instructions. The agent — which treats MCP server output as trusted context/instructions — ingests the malicious payload alongside the legitimate documentation.

4. Agent-as-proxy execution: The hijacked agent executes the injected instructions using its own local capabilities. The documented malicious behaviors are:

   • Credential theft: reading environment files (.env, .env.local, .env.production, etc.) from the working directory and transmitting the contents to an attacker-controlled service — typically via an outbound HTTP/HTTPS request the agent constructs with curl, wget, or an equivalent mechanism.
   • Destructive deletion: executing recursive file deletion against the victim's filesystem (rm -rf, Remove-Item -Recurse -Force, or equivalents).

Why This Matters to the SOC

• Blast radius is the developer workstation — and everything it touches. Developer machines hold cloud keys, source code, signing certificates, SSH keys, and CI/CD tokens. Exfiltrated .env files routinely contain production database credentials and API keys. One compromised dev workstation is a supply-chain incident waiting to happen.
• The agent is the execution primitive. Traditional egress filtering and EDR tuned for malware may not flag a legitimate agent process (Node.js, Python, the IDE itself) spawning a curl to an unknown domain. That is precisely why the detections below focus on behavioral parentage and content, not signatures.
• File deletion is a wiper capability delivered through a trusted channel. A mass exploitation event against an engineering org could destroy working trees across the fleet simultaneously.

Exploitation Status

As of this writing, CVE-2026-75130 has been published by NVD with a Critical (9) rating. No public confirmation of inclusion in the CISA Known Exploited Vulnerabilities catalog was available at publication time — check the CISA KEV catalog daily, as network-exploitable, low-complexity flaws in developer tooling historically move from disclosure to exploitation quickly. The exploitation requirements are trivial (a poisoned instruction channel plus a routine agent query), so defenders should operate under the assumption of imminent weaponization and prioritize patching over waiting for confirmed in-the-wild reports.

Detection & Response

This is a technical threat. The detections below target the observable behaviors of the documented attack chain: environment-file access piped to network exfiltration, agent/toolchain processes spawning shells and network tools, and recursive deletion commands executed from developer-agent process trees. Each rule was chosen to be high-signal: the combination of secret-file reads and outbound transfer tooling in a single command line is rare in legitimate developer automation, and recursive deletion invoked by an AI agent or IDE child process should essentially never happen.

Sigma Rules

---
title: Environment File Credential Exfiltration via Shell Command
description: Detects command lines that read environment/secret files (.env and variants) in combination with network transfer tools or encode-then-send patterns, consistent with CVE-2026-75130 prompt-injected agents exfiltrating credentials to attacker-controlled services.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75130
  - https://attack.mitre.org/techniques/T1552/
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/06/06
status: experimental
id: 3f7a2c91-6b1e-4d58-a9c4-8e2f0b5d1a77
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.exfiltration
  - attack.t1041
logsource:
  category: process_creation
  product: windows
detection:
  selection_env:
    CommandLine|contains:
      - '.env'
  selection_transfer:
    CommandLine|contains:
      - 'curl '
      - 'wget '
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'iwr '
      - 'certutil -encode'
      - 'ncat '
      - 'nc -'
  condition: selection_env and selection_transfer
falsepositives:
  - Rare legitimate deployment scripts that read .env values and call remote APIs; review parent process and destination
level: high
---
title: Recursive File Deletion Spawned by AI Agent or MCP Toolchain Process
description: Detects recursive/forced deletion commands whose parent process is an AI coding agent, IDE, Node.js, or Python MCP toolchain component. Consistent with the destructive file-deletion behavior documented in CVE-2026-75130, where a prompt-injected agent executes deletion on the victim host.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75130
  - https://attack.mitre.org/techniques/T1485/
author: Security Arsenal
date: 2026/06/06
status: experimental
id: 91c4e7b2-2d6f-4a83-b5e1-7c0d3f9a2e44
tags:
  - attack.impact
  - attack.t1485
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\python.exe'
      - '\python3.exe'
      - '\Code.exe'
      - '\cursor.exe'
      - '\claude.exe'
      - '\mcp-server.exe'
  selection_delete:
    CommandLine|contains:
      - 'Remove-Item'
      - 'rm -rf'
      - 'rd /s /q'
      - 'rmdir /s /q'
      - 'del /f /s /q'
  selection_recurse:
    CommandLine|contains:
      - '-Recurse'
      - '-rf'
      - '-r -f'
      - '/s'
  condition: selection_parent and selection_delete and selection_recurse
falsepositives:
  - Build/cleanup scripts (npm clean, cache purges) running under Node; baseline legitimate cleanup tasks and alert on new paths
level: high

KQL — Microsoft Sentinel / Defender

This query hunts the core exfiltration behavior across both Windows (DeviceProcessEvents) and Linux ingestion (Syslog): any process whose command line touches environment/secret files while also invoking outbound transfer tooling. Run it over at least the last 14 days on all developer workstations, and extend it with a second clause to catch deletion activity from agent process trees.

// Hunt: .env access combined with network exfiltration tooling (CVE-2026-75130 behavior)
let lookback = 14d;
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where ProcessCommandLine has_any (".env", "wp-config", "credentials", "secrets.yml")
| where ProcessCommandLine has_any ("curl", "wget", "Invoke-WebRequest", "Invoke-RestMethod", "nc ", "ncat", "scp ", "ftp ")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc;
// Hunt: recursive deletion spawned by AI agent / MCP toolchain processes
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName in~ ("node.exe", "python.exe", "python3.exe", "code.exe", "cursor.exe", "claude.exe")
   or InitiatingProcessFileName has "mcp"
| where ProcessCommandLine has_any ("rm -rf", "Remove-Item", "rmdir /s", "rd /s")
   and ProcessCommandLine has_any ("-Recurse", "-rf", "/s")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by TimeGenerated desc;
// Hunt: MCP/agent processes making outbound connections to rare external destinations
DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName in~ ("node.exe", "python.exe", "python3.exe", "cursor.exe", "claude.exe")
   or InitiatingProcessFileName has "mcp"
| where RemoteIPType == "Public" and RemotePort in (80, 443, 8080, 8443)
| summarize ConnectionCount = count(), DistinctDestinations = dcount(RemoteUrl) by DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| order by ConnectionCount asc;

Tune the third query by establishing a baseline of expected MCP/documentation endpoints for your environment — the value is in surfacing new, low-frequency destinations contacted by agent processes shortly after documentation requests.

Velociraptor VQL

Deploy this as a hunt across your developer fleet to identify live processes exhibiting the exfiltration pattern, plus recent evidence of agent-spawned shells:

-- Hunt: processes with .env access combined with exfiltration or deletion tooling
-- Targets live evidence of CVE-2026-75130 prompt-injection execution on developer endpoints
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (
    CommandLine =~ '(?i)\.env'
    AND CommandLine =~ '(?i)(curl|wget|invoke-webrequest|invoke-restmethod|ncat|nc |scp |ftp )'
  )
  OR (
    CommandLine =~ '(?i)(rm -rf|remove-item|rmdir /s|rd /s)'
    AND (
      Exe =~ '(?i)(node|python|cursor|code|claude)'
      OR CommandLine =~ '(?i)mcp'
    )
  )

Follow up on hits by pulling the parent process tree (pslist(pid=...) walking up Ppid), collecting the agent conversation/session logs where available, and capturing network connections with netstat() for the suspect Pids to identify the exfiltration destination.

Remediation / Verification Script

Use this Bash script on developer workstations and build agents (Linux/macOS) to identify installed Context7 versions, flag vulnerable instances, and audit MCP client configurations for the Custom AI Instructions feature. Run it via your EDR/MDM across the fleet.

#!/bin/bash
# CVE-2026-75130 verification and hardening script — Context7 MCP server
# Run on developer workstations and CI runners. Requires appropriate privileges.

VULN_MAX="2.1.2"
echo "[+] Checking for Context7 installations and versions..."

# 1. Locate globally installed Context7 via npm
if command -v npm >/dev/null 2>&1; then
  CTX_VER=$(npm ls -g --depth=0 2>/dev/null | grep -i "context7" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
  if [ -n "$CTX_VER" ]; then
    echo "    Found Context7 (npm global): $CTX_VER"
    if [ "$(printf '%s\n%s\n' "$VULN_MAX" "$CTX_VER" | sort -V | head -n1)" = "$CTX_VER" ]; then
      echo "[!!] VULNERABLE: Context7 $CTX_VER is at or below $VULN_MAX — upgrade immediately."
    else
      echo "[OK] Context7 $CTX_VER is above $VULN_MAX."
    fi
  fi
fi

# 2. Search for local project installs
find /home /Users /opt /srv -maxdepth 6 -type d -name "context7" -path "*node_modules*" 2>/dev/null | while read -r d; do
  PKG="$(dirname "$d")/context7/package.json"
  [ -f "$PKG" ] || PKG="$d/package.json"
  if [ -f "$PKG" ]; then
    V=$(grep -oE '"version"[^0-9]*[0-9]+\.[0-9]+\.[0-9]+' "$PKG" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
    echo "    Found local install: $PKG (version $V)"
  fi
done

# 3. Audit MCP client configs for Custom AI Instructions / untrusted instruction sources
echo "[+] Auditing MCP client configurations..."
for cfg in "$HOME/.cursor/mcp.json" "$HOME/.config/claude/claude_desktop_config.json" "$HOME/.vscode/mcp.json" "$HOME/Library/Application Support/Claude/claude_desktop_config.json"; do
  if [ -f "$cfg" ]; then
    echo "    Config found: $cfg"
    grep -i -E "custom|instruction|context7" "$cfg" && echo "[!!] Review: custom instructions or Context7 entries present — disable until patched."
  fi
done

# 4. Check shell histories for exfiltration/deletion indicators (triage aid)
echo "[+] Triage: recent suspicious commands in shell history..."
grep -h -E "\.env.*(curl|wget|nc |scp )|rm -rf" "$HOME/.bash_history" "$HOME/.zsh_history" 2>/dev/null | tail -n 20

echo "[+] Done. Escalate any [!!] findings to the SOC immediately."

Remediation

1. Upgrade Context7 immediately. All versions through 2.1.2 are vulnerable. Upgrade to the latest release beyond 2.1.2 published by the Context7 maintainers, and pin the version in package.json/lockfiles so CI does not silently roll back. Verify every install location — global npm installs, per-project node_modules, and any containers or devcontainer images embedding the server.
2. Disable the Custom AI Instructions feature until patched. Where the MCP client or Context7 configuration exposes custom instruction content, turn it off. If the feature cannot be disabled independently, temporarily disconnect the Context7 MCP server from all agents and fall back to vendor-hosted documentation.
3. Audit MCP server trust boundaries. Inventory every MCP server registered in your developers' clients (Cursor, Claude Desktop, VS Code, etc.). Remove or pin any server fetched dynamically from the network without integrity verification. Treat MCP server responses as untrusted input — this incident proves they are an instruction-injection channel.
4. Constrain agent capabilities. Run coding agents with least privilege: no shell execution without human approval where the client supports it, no unsupervised recursive deletion, and no read access to .env, .ssh, cloud credential directories (~/.aws, ~/.azure, ~/.config/gcloud), or browser credential stores. Use workspace-scoped filesystem permissions.
5. Protect secrets at rest. Move secrets out of .env files on workstations into a secrets manager (e.g., a vault-backed CLI that injects at runtime). Enforce .env exclusions in agent context windows where the tooling supports it, and rotate all credentials that were present in environment files on any machine that ran a vulnerable Context7 version — assume exposure.
6. Egress filtering for agent processes. Apply per-process or per-user egress policies on developer endpoints: agent/IDE processes should reach only an allowlist of documentation and model API endpoints. Alert on any new destination, as shown in the KQL section.
7. Threat-hunt retroactively. Run the detections above over at least 30 days of telemetry on all systems that had Context7 ≤ 2.1.2 installed. Look specifically for .env reads combined with outbound transfers, and for any deletion events in agent process trees.
8. Monitor authoritative sources. Track the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-75130), the Context7 project's security advisories/release notes, and the CISA KEV catalog for updates on exploitation status and any mandated remediation deadlines.

Closing

CVE-2026-75130 is a watershed example of where enterprise risk now lives: the AI agent supply chain. A CVSS 9, network-delivered flaw that turns a routine documentation lookup into credential theft and destructive deletion — executed by a trusted agent under the user's own identity — demands the same urgency you'd give a pre-auth RCE in a perimeter device. Patch Context7 past 2.1.2 today, lock down agent capabilities, rotate workstation-resident secrets, and hunt back through your telemetry. The agents your developers trust are only as trustworthy as the servers feeding them instructions.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub