title: Agentic-Flow MCP Tool-Parameter OS Command Injection (GHSA-vcv2-r9jh-99m5)
id: ATR-2026-01980
rule_version: 1
status: experimental
description: |
  Detects GHSA-vcv2-r9jh-99m5 (CWE-78): agentic-flow <= 2.0.13 MCP server tools (agentic_flow_agent, agentic_flow_create_agent, agent_booster_edit_file, agentdb_pattern_store, and related tools under standalone-stdio.ts / fastmcp servers) interpolate attacker-influenceable parameters (agent, task, name, language, agentdb arguments) directly into shell strings passed to execSync(). A parameter value that breaks out of the surrounding double-quoted argument executes arbitrary OS commands with the privileges of the MCP server process.
  Detection covers: (a) an agentic-flow tool-call argument value containing a double-quote
      breakout followed by shell command chaining (`; `, backticks, or
      `$(...)`) — the exact PoC shape from the advisory
      (task = `x"; touch /tmp/INJECTED; id > /tmp/rce.txt; echo "`);
  (b) the resulting interpolated `npx ... agentic-flow --agent/--task`
      command string itself carrying injected shell metacharacters;
  (c) explicit GHSA-vcv2-r9jh-99m5 exploitation framing.
  The detection target is the request shape — a quote-breakout + command chain inside an agentic-flow tool argument — which is the exact command-injection primitive, caught before execSync() hands it to /bin/sh -c. Bound to the agentic-flow tool surface so a benign shell-looking string elsewhere does not fire.
author: ATR Community
date: 2026/07/04
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM06:2025
  owasp_agentic:
    - ASI05:2026
    - ASI02:2026
  mitre_atlas:
    - AML.T0053 - AI Agent Tool Invocation
    - AML.T0050 - Command and Scripting Interpreter
  mitre_attack:
    - T1059 - Command and Scripting Interpreter
  ghsa:
    - GHSA-vcv2-r9jh-99m5
metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: Article 15 cybersecurity — runtime detection of agentic-flow MCP tool-parameter OS command injection.
      strength: primary
    - article: '9'
      context: Article 9 risk management — runtime risk-treatment control for agentic-flow MCP tool-parameter OS command injection.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: MAP 5.1 — adversarial input characterised/detected for agentic-flow MCP tool-parameter OS command injection.
      strength: primary
    - subcategory: MG.3.2
      context: MANAGE 3.2 — runtime monitoring control for agentic-flow MCP tool-parameter OS command injection.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: Clause 8.1 operational control — detection of agentic-flow MCP tool-parameter OS command injection payload.
      strength: primary
    - clause: '8.3'
      context: Clause 8.3 AI risk treatment — runtime detection as treatment control.
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: command-injection
  scan_target: mcp
  confidence: high
  source: ghsa-disclosure
  vendor_sources: agentic-flow-ghsa-vcv2-r9jh-99m5
agent_source:
  type: tool_call
  framework:
    - agentic-flow
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - A tool_args value that legitimately contains a semicolon or backtick as literal text data (e.g. discussing shell syntax) without an adjacent quote-breakout shape.
    - Security advisory or PR text quoting the GHSA-vcv2-r9jh-99m5 payload for review purposes.
    - A benign agentic-flow agent/task value with no quote character or shell metacharacter.
  conditions:
    - field: tool_args
      operator: regex
      value: (?i)\b(?:agent|task|name|language|agentdb)["\x27]?\s*[:=]\s*["\x27][^"\x27\n]{0,200}["\x27]\s*;\s*[\s\S]{0,120}\b(?:touch|rm|curl|wget|cat|id|nc|bash|sh|chmod|echo)\b
      description: |
        agentic-flow tool argument (agent/task/name/language/agentdb) whose value breaks out of its quote with `";` followed by a chained shell command — the canonical GHSA-vcv2-r9jh-99m5 PoC shape.
    - field: tool_args
      operator: regex
      value: (?i)npx\s+--yes\s+agentic-flow[\s\S]{0,80}--(?:agent|task)\s+"[^"\n]{0,200}"\s*;\s*[\s\S]{0,120}\b(?:touch|rm|curl|wget|cat|id|nc|bash|sh|chmod)\b
      description: |
        The interpolated `npx --yes agentic-flow --agent/--task` command string itself carrying an injected chained shell command after the closing quote — the post-interpolation execSync() payload.
    - field: tool_args
      operator: regex
      value: (?i)["\x27][^"\x27\n]{0,200}["\x27]\s*;[\s\S]{0,80}`[^`\n]{0,120}`|["\x27][^"\x27\n]{0,200}["\x27]\s*;[\s\S]{0,80}\$\([^)\n]{0,120}\)
      description: |
        Quote-breakout followed by a backtick or $() command substitution inside an agentic-flow tool argument.
    - field: content
      operator: regex
      value: (?i)GHSA-vcv2-r9jh-99m5[\s\S]{0,200}(?:agentic-flow|execSync|command\s*inject|RCE)
      description: |
        Explicit GHSA-vcv2-r9jh-99m5 reference combined with agentic-flow command-injection language — attack framing in a skill or tool description.
response:
  actions:
    - alert
  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 241/5352 = 4.50% exceeds the 2% automatic-demotion line; ceiling = observe. Removed block_tool(interrupt). Detection unchanged — recall cost is zero.'
  message_template: |
    [ATR-2026-01980] CRITICAL: Agentic-Flow MCP tool-parameter OS command injection detected (GHSA-vcv2-r9jh-99m5, CWE-78). A tool argument breaks out of its shell quote and chains a command; agentic-flow <= 2.0.13 interpolates this into execSync() unsanitized. Block the tool call and upgrade agentic-flow to >= 2.0.14.
confidence: 85