{"id":"PYSEC-2026-559","summary":"Upsonic: remote code execution vulnerability in its MCP server/task creation functionality","details":"Upsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality. The application allows users to define MCP tasks with arbitrary command and args values. Although an allowlist exists, certain allowed commands (npm, npx) accept argument flags that enable execution of arbitrary OS commands. Maliciously crafted MCP tasks may lead to remote code execution with the privileges of the Upsonic process. In version 0.72.0 Upsonic added a warning about using Stdio servers being able to execute commands directly on the machine.","aliases":["CVE-2026-30625","GHSA-cw73-5f7h-m4gv"],"modified":"2026-07-01T20:23:10.875949Z","published":"2026-06-29T11:50:46.859098Z","references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30625"},{"type":"WEB","url":"https://github.com/Upsonic/Upsonic/commit/855053fce0662227d9246268ff4a0844b481a305"},{"type":"PACKAGE","url":"https://github.com/Upsonic/Upsonic"},{"type":"WEB","url":"https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem"},{"type":"PACKAGE","url":"https://pypi.org/project/upsonic"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cw73-5f7h-m4gv"}],"affected":[{"package":{"name":"upsonic","ecosystem":"PyPI","purl":"pkg:pypi/upsonic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.72.0"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.11.0","0.11.1","0.11.10","0.11.11","0.11.2","0.11.3","0.11.4","0.11.5","0.11.6","0.11.7","0.11.8","0.11.9","0.12.0","0.12.1","0.12.2","0.12.3","0.12.4","0.12.5","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.14.1","0.14.2","0.14.3","0.15.0","0.16.0","0.16.1","0.17.0","0.17.1","0.18.0","0.19.0","0.19.1","0.19.2","0.19.3","0.19.4","0.20.0","0.20.1","0.20.2","0.20.3","0.21.0","0.22.0","0.23.0","0.23.1","0.23.2","0.23.3","0.23.4","0.24.0","0.24.1","0.24.2","0.25.0","0.26.0","0.27.0","0.28.0","0.28.1","0.28.2","0.28.3","0.28.4","0.30.0","0.30.2","0.30.7","0.32.0","0.33.1","0.34.0","0.34.1","0.34.2","0.34.3","0.35.0a1736970242","0.35.0a1736970720","0.35.0a1736971149","0.35.0a1736971897","0.35.0a1736972885","0.35.0a1736974243","0.35.0a1736975119","0.35.0a1736976284","0.35.0a1736978167","0.35.0a1736979941","0.35.0a1736981630","0.35.0a1736982287","0.35.0a1736982640","0.35.0a1736983736","0.35.0a1736984772","0.35.0a1736986092","0.35.0a1737010781","0.35.0a1737010942","0.35.0a1737015222","0.35.0a1737016349","0.35.0a1737023679","0.35.0a1737033652","0.35.0a1737033931","0.35.0a1737034519","0.35.0a1737042503","0.35.0a1737042958","0.35.0a1737043600","0.35.0a1737044257","0.35.0a1737044843","0.35.0a1737045225","0.35.0a1737114840","0.35.0a1737114977","0.35.0a1737116875","0.35.0a1737117468","0.35.0a1737122839","0.35.0a1737195981","0.35.0a1737212799","0.35.0a1737217937","0.35.0a1737218956","0.35.0a1737227112","0.35.0a1737311492","0.35.0a1737315034","0.35.0a1737379903","0.36.0","0.36.0a1737396881","0.36.0a1737401408","0.36.0a1737407655","0.36.0a1737409215","0.36.0a1737410849","0.36.0a1737438831","0.36.0a1737457705","0.36.0a1737482268","0.36.0a1737482779","0.36.0a1737487622","0.36.0a1737496270","0.36.0a1737496729","0.36.0a1737498136","0.36.0a1737539419","0.36.0a1737542896","0.36.0a1737628376","0.37.0","0.38.0","0.38.0a1737809635","0.38.1","0.38.1a1738355936","0.39.0","0.39.0a1738407703","0.39.0a1738408485","0.39.0a1738409132","0.39.0a1738413952","0.39.0a1738417207","0.4.10","0.4.11","0.4.12","0.4.13","0.4.14","0.4.15","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.4.8","0.4.9","0.40.0","0.40.1","0.40.1a1738430067","0.40.1a1738431780","0.40.2","0.40.3","0.40.4","0.40.4a1738504324","0.40.5","0.40.5a1738608355","0.40.5a1738609512","0.40.5a1738609921","0.40.5a1738610310","0.40.5a1738610551","0.40.6","0.40.6a1738619561","0.40.7","0.40.7a1738837197","0.40.7a1738851334","0.40.7a1738858117","0.40.7a1738865999","0.40.7a1738874469","0.41.0","0.41.0a1738875992","0.41.0a1738913481","0.41.0a1738922922","0.41.0a1738942849","0.41.0a1738943864","0.41.0a1738947565","0.41.0a1738948334","0.41.0a1738949488","0.41.0a1738951496","0.41.0a1738961482","0.41.0a1739006911","0.41.1","0.42.0","0.42.0a1739015944","0.42.0a1739029428","0.42.0a1739042238","0.42.0a1739042985","0.42.0a1739044180","0.42.0a1739044629","0.42.0a1739047263","0.42.0a1739048896","0.42.0a1739050234","0.42.0a1739093954","0.42.0a1739099062","0.43.0","0.43.0a1739106873","0.43.0a1739383942","0.43.0a1739389035","0.43.0a1739429679","0.44.0","0.44.0a1739451866","0.44.0a1739565955","0.44.1","0.44.1a1739799852","0.44.1a1739881595","0.44.1a1739897729","0.44.1a1739899475","0.44.1a1739904268","0.44.1a1739905596","0.44.1a1739908048","0.44.1a1739909460","0.44.1a1739912278","0.44.1a1739949863","0.44.1a1739953863","0.44.1a1739958116","0.44.1a1739969973","0.44.1a1739983135","0.44.2","0.44.2a1740050593","0.44.2a1740071168","0.44.2a1740084271","0.44.2a1740085443","0.44.2a1740085570","0.45.0","0.45.1","0.45.2","0.45.3","0.45.4","0.46.0","0.46.1","0.47.0","0.47.1","0.47.2","0.47.3","0.47.4","0.47.5","0.47.5a1741824272","0.47.5a1741825046","0.47.5a1741825731","0.47.5a1741826544","0.48.0","0.49.0","0.49.0a1742393199","0.49.0a1742655039","0.49.0a1742657799","0.49.0a1742658030","0.5.0","0.50.0","0.50.0a1742865563","0.50.0a1742876514","0.50.0a1742886287","0.50.0a1742907455","0.50.0a1742975161","0.50.1","0.50.2","0.50.3","0.50.4","0.50.4a1743070636","0.50.5","0.51.0","0.51.1","0.51.2","0.52.0","0.52.1","0.52.1a1744119894","0.52.2","0.52.3","0.52.3a1744217583","0.52.4","0.53.0","0.53.1","0.54.0","0.55.0","0.55.1","0.55.2","0.55.3","0.55.4","0.55.5","0.55.6","0.55.6a1748524485","0.55.6a1748537170","0.55.6a1748538406","0.55.6a1748538717","0.55.6a1748545381","0.55.6a1748787282","0.55.6a1748962305","0.55.6a1749087129","0.55.6a1749087663","0.55.6a1749164000","0.55.6a1749165639","0.55.6a1749248294","0.56.0","0.56.1","0.58.0","0.59.0","0.59.1","0.59.10","0.59.11","0.59.2","0.59.3","0.59.4","0.59.5","0.59.6","0.59.7","0.59.8","0.59.8a1751106705","0.59.8a1751108327","0.59.8a1751108999","0.59.8a1751109262","0.59.8a1751111016","0.59.8a1751112652","0.59.8a1751112677","0.59.9","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.60.0","0.60.0a1753281532","0.60.0a1754435135","0.60.0a1756572336","0.60.0a1757458308","0.61.0","0.61.1","0.61.1a1758720414","0.61.1a1759438459","0.61.1a1759760384","0.61.1a1759760412","0.62.0","0.62.0a1759841118","0.62.0a1760004468","0.63.0","0.64.1","0.64.1a1760634145","0.65.0","0.65.1","0.66.0","0.66.1","0.66.1a1762937055","0.66.1a1762974632","0.66.1a1763030132","0.67.0","0.67.0a1763483513","0.67.1","0.67.1a1764068527","0.67.2","0.67.2a1764090224","0.67.2a1764093269","0.67.3","0.67.4","0.68.0","0.68.1","0.68.1a1765014482","0.68.1a1765105855","0.68.1a1765124818","0.68.2","0.68.3","0.68.3a1765794146","0.68.3a1765819014","0.68.3a1765819244","0.69.0","0.69.1","0.69.1a1766049382","0.69.2","0.69.3","0.7.0","0.7.1","0.7.2","0.70.0","0.71.0","0.71.1","0.71.2","0.71.3","0.71.3a1769867798","0.71.3a1769872847","0.71.4","0.71.5","0.71.6","0.72.0a1770588559","0.72.0a1770821888","0.72.0a1770914087","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/upsonic/PYSEC-2026-559.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}