atxp vulnerabilities

Products

• gemini-cli-extension 1

Latest atxp CVEs

Newest publication first

1. CVE-2026-117560 ATXP Gemini CLI Extension through 1.0.0 OS Command Injection via MCP Tools

   Published 2026-10-27

   High·CVSS 8.5 EPSS 0.65%

   ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $() or backtick substitu...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.