A poisoned Context7 entry can make agents leak secret files
The same bug has two scores, 9.0 and 6.4, because the server only carries the text and the agent causes the damage.
On 18 August 2026, VulnCheck published CVE-2026-75130, a bug in Context7. Upstash operates Context7, a documentation server that agents for software code query. Noma Security says a poisoned entry made an agent read secret files, send them to an attacker and erase local folders. The package had 4,064,176 downloads in 30 days. No victim is recorded.
How it works
A library owner can attach guidance to a documentation entry. Context7 sends it to each agent that looks up the library, and no step cleans it. Noma says the poisoned rules told the agent to read each env file (a file of secret data), post the data as a GitHub issue and erase folders. The server cannot operate code or get access to the network. The agent does that.
The numbers
The bug has a score of 9.0, critical, on CVSS 3.1. It has 6.4, medium, on CVSS 4.0. CVSS is a scale for how bad a bug is. GitHub shows it as medium.
What is not known
Noma says Upstash repaired the bug on 23 February 2026. The bug range ends at version 2.1.2, and the release notes do not give the repair. VulnCheck and Noma do not say if the repair worked.
Insight: The server is safe, so the agent owner holds the risk
CVSS 4.0 records no effect on Context7 itself. A different test in October 2026 used text in a repository to make agents propose a wide rule in 58% of tests. This reads as a move of risk: the text source scores no damage to itself, and the agent owner must set the limits. Check which rights your agents keep after they read external text.
Sources
Posted
