Recommended action

Update kubectl-mcp-server to 1.2.0; kubectl-mcp-server to 1.2.0 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page affects kubectl-mcp-server (npm), kubectl-mcp-server (pip). Severity is critical. An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim system via user interaction with a crafted HTML page.

AI coding agents often install or upgrade packages automatically in npm and pip. A critical vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Recommended action

Update kubectl-mcp-server to 1.2.0; kubectl-mcp-server to 1.2.0 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page affects kubectl-mcp-server (npm), kubectl-mcp-server (pip). Severity is critical. An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim system via user interaction with a crafted HTML page.

AI coding agents often install or upgrade packages automatically in npm and pip. A critical vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software