CVE-2026-75130: Context7 Prompt Injection RCE Vulnerability

CVE-2026-75130 Overview

CVE-2026-75130 is a prompt injection vulnerability in Context7 through version 2.1.2. The flaw resides in the Custom AI Instructions feature served through the Model Context Protocol (MCP) server. Attackers can poison the custom instructions with unsanitized content that connected AI coding agents execute as trusted directives. Exploitation triggers when the victim's agent issues a routine library documentation request. The injected instructions can exfiltrate credentials from environment files to attacker-controlled infrastructure and perform destructive file deletion on the developer workstation. The vulnerability was disclosed publicly through advisories from Noma Security, Upstash, and Vulncheck.

Critical Impact
A single poisoned Context7 library entry can silently steal .env secrets and destroy files on any developer machine whose AI agent queries the MCP server.

Affected Products

Context7 MCP server versions up to and including 2.1.2
AI coding agents that consume Context7 Custom AI Instructions through MCP
Developer environments where Context7 is registered as an MCP tool provider

Discovery Timeline

2026-08-18 - CVE-2026-75130 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75130

Vulnerability Analysis

Context7 is an MCP server that supplies AI coding agents with up-to-date library documentation and Custom AI Instructions. The server delivers these instructions inline to the agent's context window without sanitization or provenance boundaries. Because large language model agents treat MCP tool output as authoritative guidance, adversarial text embedded in instructions is executed as if authored by the user.

The issue is a business-logic and input-validation failure at the AI trust boundary. The MCP protocol carries the payload faithfully, but Context7 does not isolate untrusted library metadata from control instructions the agent will act on. Impact scales with the agent's local permissions, which typically include shell execution, file system access, and outbound network calls.

Root Cause

The root cause is missing sanitization of user-contributed content in the Custom AI Instructions pipeline. Context7 concatenates third-party instruction text into responses returned by the MCP server. No delimiter enforcement, output filtering, or instruction-versus-data separation is applied before the content reaches the agent.

Attack Vector

An attacker submits or edits a Context7 library entry containing hidden imperative text. When a developer's AI coding agent later requests documentation for that library, Context7 returns the poisoned instructions. The agent interprets the injected directives and performs attacker-chosen actions in the developer's session. Documented outcomes include reading .env files, transmitting the contents to an attacker-controlled endpoint, and issuing file deletion commands against the local workspace. User interaction is limited to the routine act of prompting the agent for library help.

For technical walkthroughs, see the Noma Security research on ContextCrush and the Vulncheck advisory on Context7 prompt injection.

Detection Methods for CVE-2026-75130

Indicators of Compromise

Outbound HTTP or DNS traffic from developer workstations to unrecognized domains immediately following AI agent queries against Context7
Recent reads of .env, .envrc, credentials, or ~/.aws/ files by IDE or agent processes without corresponding developer activity
Unexpected rm, del, or unlink operations against project directories initiated by an AI agent process tree
MCP session logs containing library documentation responses with embedded imperative phrases such as "ignore previous instructions" or shell command fragments

Detection Strategies

Inspect MCP server responses for control tokens, executable code fences, or exfiltration URLs before they reach the agent
Correlate AI agent tool-call telemetry with process, file, and network events on the same host to surface instruction-to-action anomalies
Baseline normal Context7 response sizes and content patterns and alert on outliers containing new outbound destinations

Monitoring Recommendations

Log all MCP tool invocations, arguments, and returned payloads to a centralized store for retrospective search
Monitor developer endpoints for reads of secret files followed by outbound network transmissions within a short time window
Track Context7 client version across the fleet and alert on hosts still running versions at or below 2.1.2

How to Mitigate CVE-2026-75130

Immediate Actions Required

Disable or unregister the Context7 MCP server in AI coding agents until a fixed release is deployed and verified
Rotate any credentials, API keys, and tokens that were present in .env files on hosts where Context7 was active
Review recent MCP session transcripts and shell histories on developer workstations for signs of exfiltration or deletion activity
Restrict AI coding agents from reading secret files and from making outbound network calls to unapproved destinations

Patch Information

At publication, the enriched CVE record lists no fixed version or vendor advisory URL. Consult the Upstash MCP vulnerability disclosure and the Vulncheck advisory for the latest remediation status and upgrade guidance before re-enabling Context7.

Workarounds

Run AI coding agents inside sandboxes or containers with no access to production secrets and no default outbound network egress
Store secrets in a dedicated secrets manager rather than plaintext .env files accessible to agent processes
Enforce human approval for any agent-initiated file deletion or outbound HTTP request that was not explicitly requested by the developer
Pin MCP tool allow-lists so only vetted servers can inject content into the agent context

bash

# Configuration example: remove Context7 from an MCP client allow-list
# and require approval for destructive or network actions

# 1. Unregister the Context7 server
mcp config remove-server context7

# 2. Restrict agent capabilities in the client config
cat > ~/.config/ai-agent/policy.json <<'EOF'
{
  "allowed_mcp_servers": [],
  "require_confirmation": [
    "filesystem.delete",
    "filesystem.read:**/.env",
    "network.http_request"
  ],
  "deny_domains": ["*"],
  "allow_domains": ["registry.npmjs.org", "pypi.org"]
}
EOF