What is GHSA-94gr-w3q5-rfqr?

GHSA-94gr-w3q5-rfqr is a security advisory published by GitHub Security Advisories with Critical severity. Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page

Which CVE IDs does GHSA-94gr-w3q5-rfqr cover?

GHSA-94gr-w3q5-rfqr covers the following CVE IDs: CVE-2025-65719. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-94gr-w3q5-rfqr?

GHSA-94gr-w3q5-rfqr has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-94gr-w3q5-rfqr?

GHSA-94gr-w3q5-rfqr affects 2 products, including: npm/kubectl-mcp-server:\u003c 1.2.0; pip/kubectl-mcp-server:\u003c 1.2.0.

GHSA-94gr-w3q5-rfqrCriticalCVSS 9.8

Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page

Vendor

GitHub Security Advisories

Published

May 12, 2026

Last Modified

October 27, 2026

🔗 CVE IDs covered (1)

CVE-2025-65719 →

📋 Description

An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim system via user interaction with a crafted HTML page.

🎯 Affected products2

npm/kubectl-mcp-server:< 1.2.0
pip/kubectl-mcp-server:< 1.2.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2025-65719
https://www.ox.security/blog/cve-2025-65719-critical-rce-in-kubectl-mcp-server
https://www.ox.security/blog/kubectl-mcp-server-remote-code-execution
https://github.com/pypa/advisory-database/tree/main/vulns/kubectl-mcp-server/PYSEC-2026-371.yaml
https://pypi.org/project/kubectl-mcp-server
https://github.com/advisories/GHSA-94gr-w3q5-rfqr