Executive Summary
NVD published a CVSS 9.0 prompt-injection vulnerability in the Context7 MCP documentation server: unsanitized content from its Custom AI Instructions feature reaches connected coding agents and runs with their file, shell and network access.
What Happened
AI RiskAtlas reports that NVD published a CVSS 9.0 prompt-injection vulnerability in the widely installed Context7 MCP documentation server.[12] Unsanitized content served via its Custom AI Instructions feature can be delivered into a connected coding agent’s context and executed with the agent’s own file, shell, and network access, creating a high-severity path for code execution and data compromise in developer and SaaS environments.[12]
Affected Products
- Context7 MCP server
Vulnerability / Attack Technique
Prompt injection delivered through an MCP documentation server
Technical Mechanism
Content served via Custom AI Instructions is passed unsanitized into the coding agent's context, where the agent acts on it using its own tools.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Part of the MCP Security topic.
Relevant Frameworks
RealGround Analysis
A documentation source became an instruction channel into every connected coding agent. RealGround analysis: MCP servers are trusted inputs by default and must be vetted like dependencies.
Recommended Controls
- Update Context7 MCP or disable Custom AI Instructions
- Allowlist MCP servers for coding agents
- Require approval for shell commands proposed after reading external docs
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
AI RiskAtlas: https://riskatlas.principle.sg/cases
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.