CVE record published for the Context7 custom-rules prompt injection Upstash fixed in February

VulnCheck published CVE-2026-75130 on 2026-08-18, assigning a record to a prompt injection in Context7 that Noma Security disclosed on 2026-03-05 under the name ContextCrush. Context7, published by Upstash, serves version-specific library documentation to coding agents and ranks fifth on the 2026-08-14 MCP 500.

The injection vector was the platform's own publishing feature. Library owners could set "AI Instructions", also called Custom Rules, through the Context7 dashboard, and Noma's report states those rules were served verbatim through the MCP server to every user who queried that library, with no sanitization and nothing marking them apart from the documentation arriving through the same channel. Anyone with a GitHub account could register a library. Noma's researchers also manufactured the platform's own credibility signals for their test library, earning a trending badge and a top 4% ranking through self-generated API requests, MCP requests and page views.

Noma's write-up is precise about where execution happened. The Context7 MCP server exposes two tools, resolve-library-id and query-docs, and cannot run code, write files or make network requests. The agent that consumed the poisoned rules could do all three. In their demonstration, the instructions had the agent read .env files from the project root, post the contents to an attacker-controlled GitHub repository as an issue, and then delete local files under the guise of cleanup.

Severity is recorded differently by the two parties. Noma describes it as critical. VulnCheck's record carries CVSS 4.0 6.4, medium, and CVSS 3.1 9.0, critical.

The version range does not convey how the fix reached users. Noma's timeline runs from a 2026-02-18 report to Upstash accepting it on 2026-02-19 and deploying a production fix on 2026-02-23 with rule sanitization and guardrails, five days after the report and ten days before public disclosure. Because the poisoned content was served by Upstash's hosted registry, that fix took effect for everyone at once rather than through an upgrade. VulnCheck's record expresses the affected range against the package instead, as "Context7 through 2.1.2"; 2.1.2 was published 2026-02-23 and 2.1.3 on 2026-03-04. The current release is 4.0.2.