The injection moved into the SDK. The registry names the class.
On April 15, 2026, OX Security disclosed a systemic command-injection root cause in the MCP STDIO layer: 12 CVEs across four exploit families, most still unpatched. It sits in the shared foundation the ecosystem builds on, not in one server. A trust registry either maps a class like this or it is decoration. Here is exactly what Conformant observes remotely, and exactly what an operator attests, with every attestation anchored.
Root cause
A systemic command-injection root cause in the MCP STDIO layer: user-controlled commands run directly on the host, without authentication and without sanitization. The flaw sits in the shared foundation the ecosystem builds on, not in one server.
Family 1. Unauthenticated & authenticated command injection via MCP STDIO OPERATOR-ATTESTED
A malicious command placed in an MCP STDIO configuration entry runs directly on the host with no authentication and no sanitization.
Family 2. STDIO config injection with hardening bypass OPERATOR-ATTESTED
Argument flags (e.g. `npx -c <command>`) slip a command past an allowlist that only inspected the base binary.
Family 3. Config-edit injection via prompt injection OPERATOR-ATTESTED
A prompt-injected agent rewrites the client's MCP configuration (observed in IDEs such as Windsurf), planting a command the host then runs.
Family 4. Hidden STDIO configuration via network request REMOTELY OBSERVABLE
An intercepted or malicious network response flips a client's transport from HTTP/SSE to STDIO, smuggling in a command-bearing configuration.
LangFlow, GPT Researcher, LiteLLM, Agent Zero, LangBot, Fay, Bisheng, Jaaz, Langchain-Chatchat, Upsonic, Flowise, Windsurf, DocsGPT, LettaAI, plus foundation-layer tooling: Anthropic MCP SDK, LangChain, FastMCP, NVIDIA NeMo. Most affected products remained unpatched or only partially patched at disclosure; DocsGPT and LettaAI had shipped fixes.
How Conformant handles this class: the honest boundary
Three of the four families are local STDIO config-injection: they live in a client's configuration and on the host, not at a URL. A remote probe cannot honestly test them, and Conformant does not pretend to. What the public scanner does observe (and reports on every scan as the CFM-09 advisory line) is the sink surface the class ultimately targets: command-execution tools, command-shaped parameters, and server content that tries to steer a client's transport to STDIO (family 4, the one remotely observable path).
The local families are covered by operator attestation: a signed, Rekor-anchored declaration that a server's STDIO configuration is hardened against families 1–3. Attestation is a claim with a public, tamper-evident record behind it, not a press mention. That is what makes a second grade a re-verification instead of a trust-me.
Source: OX Security's MCP supply-chain advisory, published 2026-04-15. Conformant maps and tracks this class; it did not discover it. Run the public scanner to see the CFM-09 advisory for any server: conformant.io/scan.