Context7 CVE-2026-75130: hosted remediation and untrusted custom rules

What it is

Status as of 25 October 2026. Re-check the vendor clarification and CNA advisory together: they describe the affected scope differently. VulnCheck's advisory dated 18 August 2026 assigns CVE-2026-75130 to injected custom instructions served through Context7 and lists versions through 2.1.2. CNA advisory.

Context7's clarification, published on 22 October 2026, says the flaw was in its hosted Custom Rules service and the fix was deployed on 23 February 2026. The vendor says every client package received that service-side remediation, so no npm upgrade is required for this particular issue. It disputes treating the client version as the affected boundary and says it has requested a record correction. Report this disagreement explicitly; there is no justified client-side fixed-version number to invent. Vendor clarification.

Why it matters

Documentation can contain useful instructions for a programmer without being authorized to direct an agent's tools. Promoting retrieved text into privileged guidance lets a library contributor influence operations outside the documentation task. OWASP describes this external-content route as indirect prompt injection and recommends separating untrusted material, reducing privileges and requiring approval for sensitive actions. OWASP guidance.

Context7 says it disabled Custom Rules temporarily, added screening and restored the feature. That is a vendor-reported remediation of a specific incident. It does not establish that every future document is harmless or that an agent should obey operational requests found inside documentation.

How to apply

• Record whether the agent uses the hosted service, a local client or an independently operated integration. For a local installation, npm ls @upstash/context7-mcp --depth=0 records its installed package version; check global installations separately. This is inventory, not a test of the hosted fix. npm ls.
• Preserve the service endpoint, library identity and provenance of retrieved material in the audit record. Keep the text in a clearly labeled data channel. Do not convert a heading such as custom instructions into application-level authority.
• Remove automatic adoption of remote custom rules where it is unnecessary. Where rules are needed, approve their scope explicitly and constrain eligible documentation sources. Treat cached or saved rules as material requiring review before reuse.
• Give documentation-reading sessions only the tools and credentials necessary for their task. Enforce file destinations, outbound access and sensitive-operation approvals outside the model. These controls implement OWASP's separation and least-privilege recommendations.
• As a proposed acceptance check, confirm that a normal documentation lookup cannot silently grant new capabilities or change the agent's approval policy. Record the actual tool actions, not just the final answer.
• Investigate unexpected credential access, outbound transfers or file changes after a lookup. Preserve the retrieved response and subsequent call history. Revoke credentials if exposure is established; rebuilding a client alone cannot recall disclosed secrets.

Pitfalls

Do not present the old absence of a fixed version as proof that the hosted flaw remains unremediated. Conversely, a vendor's screening claim is not an independent guarantee against prompt injection. Keep the service's reported fix status distinct from the capability limits enforced by the agent operator.