ContextCrush: Remote Code Execution via Malicious MCP Server

ContextCrush Vulnerability Summary Overview Vulnerability Name: ContextCrush Vulnerability Type: MCP (Model Context Protocol) Server Vulnerability Description: Attackers can construct malicious MCP servers to induce users to connect, subsequently executing arbitrary code, stealing data, or compromising the system. This vulnerability exploits flaws in the "trust model" of the MCP protocol, leveraging Custom Tools to achieve Remote Code Execution (RCE). Affected Components: All AI applications supporting the MCP protocol (e.g., Cursor, Claude Desktop, Windsurf, etc.) Risk Level: High (CVSS score not provided, but it allows complete control over the target system) Impact Scope Affected Systems: - All AI applications utilizing the MCP protocol (including Cursor, Claude Desktop, Windsurf, Open WebUI, etc.) - All users connecting to malicious MCP servers Attack Vectors: - User-initiated connection to a malicious MCP server - Server execution of arbitrary code via "Custom Tools" - Theft of sensitive data (e.g., API keys, environment variables, file system contents) Consequences: - Remote Code Execution (RCE) - Data leakage (including user credentials, configuration files, local files) - Complete system compromise Remediation Short-term Mitigation: - Avoid connecting to untrusted MCP servers - Disable the "Custom Tools" feature (if possible) - Use official or known-secure MCP servers Long-term Fix: - Refactor the trust model of the MCP protocol and introduce sandboxing/isolation mechanisms - Application layers should restrict permissions and execution environments for custom tools - Vendors should release security updates to strengthen input validation and access control Vendor Response: - Reports have been submitted to vendors such as Cursor, Claude Desktop, and Windsurf - Some vendors have confirmed the vulnerability and plan to fix it - Users are advised to wait for official patches or implement temporary mitigation measures POC Code (from page) > Note: Actual POC code may be more complex, including modules for data theft and persistence. For complete code, refer to the original report or contact the author. --- Summary: ContextCrush is a high-risk MCP protocol vulnerability that can lead to remote code execution and data leakage. Users should avoid connecting to untrusted servers, and vendors need to urgently address trust model flaws.

Goal Reached Thanks to every supporter — we hit 100%!

ContextCrush: Remote Code Execution via Malicious MCP Server