https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:40:20 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-55582 <p>mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default security.yaml allows /usr/bin/git, while security.go omits ! from containsShellMetacharacters and containsDangerousShellConstructs and applies no per-executable argument policy. A caller of the shell_exec MCP tool can provide the command argument /usr/bin/git -c alias.pwn=!&lt;arbitrary-command&gt;, causing Git to create a shell alias and execute arbitrary OS commands as the mcp-shell process user. The default Docker image runs as mcpuser with Git installed and secure mode enabled, so the bypass is exploitable in the default deployment without additional authentication beyond MCP connectivity. This issue is fixed in version 0.6.0.</p> <p>mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default security.yaml allows /usr/bin/git, while security.go omits ! from containsShellMetacharacters and containsDangerousShellConstructs and applies no per-executable argument policy. A caller of the shell_exec MCP tool can provide the command argument /usr/bin/git -c alias.pwn=!&lt;arbitrary-command&gt;, causing Git to create a shell alias and execute arbitrary OS commands as the mcp-shell process user. The default Docker image runs as mcpuser with Git installed and secure mode enabled, so the bypass is exploitable in the default deployment without additional authentication beyond MCP connectivity. This issue is fixed in version 0.6.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-55582 https://vulnerability.circl.lu/vuln/ghsa-74hp-mggr-hv58 <p><strong>Affected:</strong> Go: github.com/sonirico/mcp-shell</p> <p>### Summary</p> <p>`mcp-shell`&#39;s &#34;secure mode&#34; is designed to restrict command execution to an allowlist of executables defined in `security.yaml`. The default configuration includes `/usr/bin/git`. The security validator in `security.go` blocks common shell metacharacters (`|&amp;;&lt;&gt;(){}[]$\``) but omits `!`, which is the prefix Git uses to execute shell aliases (`alias.NAME=!CMD`). An attacker who can invoke the `shell_exec` MCP tool can pass `/usr/bin/git -c alias.pwn=!&lt;arbitrary-command&gt;` as the command argument, bypassing all validation and achieving arbitrary OS command execution as the `mcp-shell` process user. The default Docker image runs as `mcpuser` (UID 1000) with Git installed and secure mode enabled, making this exploitable in the default deployment with no authentication required.</p> <p>### Details</p> <p>The vulnerability is a classic OS Command Injection (CWE-78) in the `shell_exec` MCP tool handler. The data flow from attacker input to shell execution is:</p> <p>1. **`main.go:89-91`** — The MCP tool schema exposes a required string parameter `command` with no server-side type constraints. 2. **`main.go:102`** — `shell_exec` is bound to `shellHandler.handle`. 3. **`handler.go:34`** — The handler reads the attacker-controlled value: `command, err := request.RequireString(&#34;command&#34;)`. 4. **`handler.go:49`** — The command string is passed to `h.validator.validateCommand(command)`. 5. **`security.go:136`** — `containsShellMetacharacters` checks for `|&amp;;&lt;&gt;(){}[]$\`` but `!` is absent from…</p> <p><strong>Affected:</strong> Go: github.com/sonirico/mcp-shell</p> <p>### Summary</p> <p>`mcp-shell`&#39;s &#34;secure mode&#34; is designed to restrict command execution to an allowlist of executables defined in `security.yaml`. The default configuration includes `/usr/bin/git`. The security validator in `security.go` blocks common shell metacharacters (`|&amp;;&lt;&gt;(){}[]$\``) but omits `!`, which is the prefix Git uses to execute shell aliases (`alias.NAME=!CMD`). An attacker who can invoke the `shell_exec` MCP tool can pass `/usr/bin/git -c alias.pwn=!&lt;arbitrary-command&gt;` as the command argument, bypassing all validation and achieving arbitrary OS command execution as the `mcp-shell` process user. The default Docker image runs as `mcpuser` (UID 1000) with Git installed and secure mode enabled, making this exploitable in the default deployment with no authentication required.</p> <p>### Details</p> <p>The vulnerability is a classic OS Command Injection (CWE-78) in the `shell_exec` MCP tool handler. The data flow from attacker input to shell execution is:</p> <p>1. **`main.go:89-91`** — The MCP tool schema exposes a required string parameter `command` with no server-side type constraints. 2. **`main.go:102`** — `shell_exec` is bound to `shellHandler.handle`. 3. **`handler.go:34`** — The handler reads the attacker-controlled value: `command, err := request.RequireString(&#34;command&#34;)`. 4. **`handler.go:49`** — The command string is passed to `h.validator.validateCommand(command)`. 5. **`security.go:136`** — `containsShellMetacharacters` checks for `|&amp;;&lt;&gt;(){}[]$\`` but `!` is absent from…</p> https://vulnerability.circl.lu/vuln/ghsa-74hp-mggr-hv58