A widely installed documentation MCP server carried a prompt injection into connected coding agents

The document exists. The ledger fetched it at its publisher and quotes it.

Record ID

AIL-2026-0025

Kind

Injection

Jurisdiction

Global

Last verified

15 September 2026

Added

15 September 2026

• The CVE record states that the product contains a prompt injection allowing attackers to execute malicious instructions in connected AI coding agents.
• The injection arrives through unsanitised content in the custom instructions feature served by the MCP server.
• Affected versions are everything through 2.1.2 according to the CVE record.
• The record carries two scores from different versions of the scoring system, which is why published severities for it differ.
• The record was assigned by a vulnerability numbering authority rather than by the product's own vendor.

Identity, Authorization, Limits, Accountability, Revocation. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

IdentitySilent

Content served by a documentation tool reached the agent with the standing of an instruction.CVE Program record, CVE-2026-75130, primary source, 18 August 2026.

AuthorizationSilent

The record states the injected instructions execute in connected coding agents, which hold the developer's own reach.CVE Program record, CVE-2026-75130, primary source, 18 August 2026.

LimitsSilent

The record describes unsanitised content, so no filtering bounded what could arrive.CVE Program record, CVE-2026-75130, primary source, 18 August 2026.

AccountabilityStated

A public CVE record exists with an assigning authority, an affected range and published scores.CVE Program record, CVE-2026-75130, primary source, 18 August 2026.

RevocationOpen

The record names an affected range and the public documentation of a fixed release was not established here.CVE Program record, CVE-2026-75130, primary source, 18 August 2026.

1. 9 CVSS base score

   CVSS version 3.1 base score on the CVE record

   CVE Program record, CVE-2026-75130, primary source, as of 18 August 2026.

2. 6.4 CVSS base score

   CVSS version 4.0 base score on the same CVE record

   CVE Program record, CVE-2026-75130, primary source, as of 18 August 2026.

A documentation server looks like the safest thing you can connect to a coding agent, and it is an instruction channel. Keep an inventory of every MCP server your developers run, with its version and who publishes it, and subscribe to CVE feeds for each one. Treat everything a server returns as untrusted content, and never let a documentation tool's output reach an agent that can write code unreviewed.

1. CVE Program record, CVE-2026-75130Primary · 18 August 2026

• VerifiedInjectionAIL-2026-0026

  A coding assistant carried a prompt injection that let a remote attacker run commands on the user's machine

  Global · verified 15 September 2026

  The CVE record states that a prompt injection vulnerability in the named version allows remote attackers to execute arbitrary commands on a victim system.

• Reported, primary not reachedExfiltrationAIL-2026-0015

  A cloned MCP server silently copied every email agents sent through it

  Global · verified 15 September 2026

  The Register reports that a backdoored version added a blind copy of every message to an attacker controlled address.

• AbsentOpen questionAIL-2026-0037

  Has a confirmation prompt ever been documented stopping a destructive agent action in a real incident?

  Global · verified 15 September 2026

  Every incident record in this dataset that involves a destructive or irreversible action records human approval as absent, bypassed or uninformed.

• Open questionOpen questionAIL-2026-0036

  Does any published standard require an agent to hold an identity distinct from the person it acts for?

  Global · verified 15 September 2026

  The Model Context Protocol authorization specification states that clients must implement resource indicators for OAuth so that a token names the resource it is for.

• Open questionOpen questionAIL-2026-0035

  Does any registry classify AI incidents by the authority control that failed, and does anyone count agent incidents?

  Global · verified 15 September 2026

  The AI Incident Database describes itself as indexing the collective history of harms or near harms realised in the real world by deployed AI systems.

• Open questionOpen questionAIL-2026-0034

  Who is liable when an agent commits its principal to something false or binding?

  Global · verified 15 September 2026

  The Canadian tribunal decision is a small claims level decision and is not binding precedent on other courts.