Security readout for executives and security teams
Plain-English summary
Context7 can pass attacker-controlled Custom AI Instructions to connected coding agents. A routine documentation request may then cause the agent to expose credentials or delete files, depending on its permissions. This creates serious confidentiality, integrity, and availability risk for development environments.
Executive priority
Prioritize immediate exposure discovery and containment. Environments combining affected Context7 functionality with highly privileged coding agents warrant urgent action because a documentation workflow could cross into credential theft or destructive file operations. Escalate suspected activity to incident response.
Technical view
CVE-2026-75130 is an unsanitized prompt-injection flaw in Context7 through 2.1.2, delivered through its MCP server. The CVSS 3.1 score is 9.0, with network reachability, low complexity, required privileges and user interaction, changed scope, and high impact across confidentiality, integrity, and availability.
Likely exposure
Exposure is most likely where Context7 through 2.1.2 uses Custom AI Instructions with MCP-connected coding agents. Risk increases when those agents can read environment files, access valuable credentials, make outbound connections, or modify and delete local files.
Exploitation context
The cited technical disclosure describes credential exfiltration and destructive file deletion. However, the bundle marks this CVE as absent from KEV and provides no evidence of active exploitation in the wild. Treat the disclosed capability as demonstrated, not confirmed widespread abuse.
Researcher notes
CWE-1427 and the supplied narrative identify prompt injection through Custom AI Instructions. The structured affected entry lists version “0,” conflicting with the description stating through 2.1.2. No fixed version is named in the bundle, so confirm the authoritative affected range and remediation with the supplier.
Mitigation direction
- Identify Context7 deployments and determine whether Custom AI Instructions are enabled.
- Check current supplier guidance for a fixed release or officially supported mitigation.
- Pending supplier guidance, disable untrusted custom instructions or suspend affected MCP integrations.
- Restrict connected agents' filesystem, credential, network, and deletion permissions.
- Rotate credentials if logs suggest environment files or secrets were accessed unexpectedly.
Validation and detection
- Confirm installed Context7 versions and document all MCP-connected agents.
- Review custom instruction records for untrusted content or unexpected modifications.
- Inspect agent and filesystem logs for unusual secret access or file deletion.
- Review outbound network logs for unexpected destinations following documentation requests.
- Verify agents operate with least privilege and cannot access unnecessary environment files.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1427: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-75130 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H2.36VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
6.4MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Base CVSS 3.1 score
9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Noma Security BlogCVE reference, VulnCheck · technical-description, exploit
- Supplier LinkedIn PostCVE reference, VulnCheck · vendor-advisory
- https://www.vulncheck.com/advisories/context7-prompt-injection-via-custom-ai-instructionsCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input Used for LLM Prompting
Improper Neutralization of Input Used for LLM Prompting represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.