Skip to content
OpenAdvisories
Critical · 9.8 CVE-2025-65719 EUVD-2025-209796GHSA-94gr-w3q5-rfqrPYSEC-2026-371

Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page

Published May 12, 2026 · Updated May 13, 2026 · Assigned by mitre

Package: kubectl-mcp-server Package: kubectl-mcp-server Ecosystem: npm Ecosystem: PyPI

Description

An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim system via user interaction with a crafted HTML page.

Affected packages

EcosystemPackageAffectedFixedRecord
npm kubectl-mcp-server < 1.2.0 1.2.0 GHSA-94gr-w3q5-rfqr
PyPI kubectl-mcp-server < 1.2.0 1.2.0 GHSA-94gr-w3q5-rfqr

References