CLAIM-2026-08-24-01

CVE-2026-75130 (NVD, published 18 August 2026, CNA VulnCheck) is a prompt-injection vulnerability in Upstash's Context7, affecting versions 0 through 2.1.2 and classified CWE-1427; the injection is delivered through the Custom AI Instructions feature served via the Context7 MCP server.

Why it matters

The affected component is not the agent but a documentation MCP server the agent trusts by default - the dependency, not the model, is the attack surface.

Sources

• nvdnistnati2026cve
• vulncheck2026context