OX Security Advisory: Systemic MCP STDIO Command Injection Affects 150M+ Downloads and 7,000+ Servers

OX Security·high signal

OX Security disclosed four families of command injection vulnerabilities in Anthropic's MCP STDIO implementations, affecting 150M+ downloads and 7,000+ publicly accessible servers. Family 1 (direct injection) hits LangFlow, GPT Researcher, LiteLLM, and 5 others. Family 3 (prompt injection → RCE) earned a critical CVE against Windsurf (CVE-2026-30615). Root cause: arbitrary command/argument values passed directly to StdioServerParameters without sanitization. Several vendors declined patches, claiming command execution is intentional design.