Context7 MCP documentation server prompt-injection flaw

AI RiskAtlas reports that NVD published a CVSS 9.0 prompt-injection vulnerability in the widely installed Context7 MCP documentation server.[12] Unsanitized content served via its Custom AI Instructions feature can be delivered into a connected coding agent’s context and executed with the agent’s own file, shell, and network access, creating a high-severity path for code execution and data compromise in developer and SaaS environments.[12]

Reported facts: AI RiskAtlas notes that NVD has published a CVSS 9.0 prompt-injection vulnerability in the widely deployed Context7 MCP documentation server, where unsanitized content from its Custom AI Instructions feature can be injected into a connected coding agent’s context and executed with the agent’s file, shell, and network access, risking code execution and data compromise in developer and SaaS environments.[12] RealGround analysis: This is a high-impact prompt-injection path in an AI supply-chain component that can turn documentation content into a remote-code-execution vector for any integrated agent, so teams should harden agent input validation, restrict agent system privileges (file, shell, and network), and continuously red-team agent integrations against instruction injection. Organizations relying on Context7 MCP or similar MCP-style tooling should treat configuration and content sources as untrusted, maintain an AI SBOM for agent integrations, and implement compensating controls such as allowlisted commands, strict network egress policies, and runtime monitoring for anomalous agent-driven actions.