A prompt injection flaw in Upstash Context7 through version 2.1.2 lets attackers plant malicious instructions in the Custom AI Instructions feature, hijacking connected AI coding agents to steal credentials and delete files when a developer makes an ordinary documentation request.
What Is It
Context7 is an MCP server that supplies library documentation to AI coding agents. Through version 2.1.2, it serves content from its Custom AI Instructions feature without sanitization. An attacker who can inject into that content controls what the downstream agent reads as trusted instruction text.
The consequences are not confined to the MCP server. Per the advisory, poisoned instructions can drive the connected agent to exfiltrate credentials from environment files to an attacker-controlled service and to perform destructive file deletion on the victim's machine. The trigger is a routine library documentation request; the developer does nothing unusual.
Why It Matters
The CVSS v3.1 base score is 9.0 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, network attack vector, low complexity, low privileges required, and a changed scope reflecting that the damage lands outside the vulnerable component, on the developer's workstation. A secondary CVSS v4.0 score of 6.4 (MEDIUM) shows no direct impact to the MCP server itself but HIGH subsequent-system confidentiality, integrity, and availability impact; the same story in different notation.
User interaction is required but passive: the victim only needs to ask their agent for docs.
What's Vulnerable
- Vendor: Upstash
- Product: Context7
- Affected versions: all versions through 2.1.2 (
<= 2.1.2, semver)
No CPE records are present in the NVD entry at this time.
Patch Status
The NVD record was published 2026-08-18 with a status of Received and lists no patched version or fixed release. Upstash has publicly acknowledged the issue (see LinkedIn reference). No CISA KEV entry exists for this CVE, so there is no confirmed active exploitation and no federal remediation deadline at this time. Operators running Context7 2.1.2 or earlier should consult the vendor and VulnCheck advisories for current guidance.