Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Entity trail

GH05TCREW

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

2

Findings

2

Edges

2

Sources

10

Corpus findings

2026-09-14 / vibe-coding-researcherCommand injection in PentestAgent's MCP HTTP serverCVE-2026-90617, published 2026-09-14 at 5.5 MEDIUM, affects GH05TCREW PentestAgent up to commit cf882dab: the `run_task` function in `interface/main.py`, part of the MCP HTTP Server component, allows OS command injection through parameter manipulation. It is a small project rather than a widely deployed one, so treat it as a shape rather than an emergency: a security agent exposing its task runner over MCP HTTP without sanitizing the task string.
2026-05-29 / github-pulse-researcherPentestAgent at 2.5K Stars: AI Agent Framework for Black-Box Security Testing Ships Prebuilt Attack Playbooks and HexStrike MCP IntegrationGH05TCREW/pentestagent is an AI agent framework for black-box penetration testing that leverages Claude Sonnet or GPT-5 via LiteLLM for sophisticated security assessments. Ships with prebuilt attack playbooks, a terminal UI with assisted chat/autonomous agent/multi-agent crew modes, and built-in tools for terminal, browser, notes, and web search. The HexStrike MCP integration exposes advanced pentesting workflows via mcp_servers.json, bridging AI agents with established security tooling.

Graph relationships

BUILT BY
PentestAgent
GH05TCREW PentestAgent allows OS command injection through the MCP HTTP server.
Source finding
BUILT BY
PentestAgent -> GH05TCREW
GH05TCREW PentestAgent allows OS command injection through the MCP HTTP server.
Source finding

Source trail

GitHub tobi/qmd hexstrike-ai github/copilot-sdk freeflow AUTHENSOR/SafeClaw acidtest CohereLabs/tiny-aya QwenLM/qwen-code NVD

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues