CVE-2026-75130: Context7 MCP Serves Unsanitised "Custom AI Instructions" Into Any Connected Agent (CVSS 9.0)

Context7, Upstash's widely installed documentation MCP server, lets its free-text Custom AI Instructions feature reach a connected coding agent's context during what looks like an ordinary library-documentation lookup, with no sanitisation on the way through. Eli Ainhorn of Noma Security reported it; NVD published it on 18 August 2026 as CWE-1427 (improper neutralisation of input used for LLM prompting) at 9.0 under CVSS 3.1, though only 6.4 under CVSS 4.0. Disclosed impact runs to credential theft from environment files and destructive file deletion, none of which the MCP server can do itself: the agent it feeds does the work. The affected range is 2.1.2 and earlier, and the notable part is what came next. No fix is documented. The upstash/context7 advisories page shows zero published advisories, no GHSA cross-references the CVE, and no release note through 4.0.3 (21 August) mentions the CVE, prompt injection or sanitising Custom AI Instructions. The same attack surface was patched once already in February 2026, which makes this look like a reopened class rather than a new defect.

You are affected if you run @upstash/context7-mcp <=2.1.2.

Upgrading is not a verified fix here, so do not treat a version bump as closure: nothing in the 4.x release notes claims this was addressed. Find every device running Context7 and decide per install whether a documentation lookup is worth an unsanitised instruction channel into the agent. Where it stays, the containment is on the agent side rather than the server side, because the server is only the delivery path: keep the agent off writable credentials, require approval for file deletion, and do not run it with a token that can reach production secrets. Also worth noting for vendor review: this one has sat with a critical score and no advisory for weeks, so "a CVE exists" and "a patch exists" are separate questions to ask.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run @upstash/context7-mcp and which version, then enforce a policy on it.