PT-2026-126430

hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent arduino and hagent esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated...