mac-shell-mcp CVE-2026-108953

Exploitation requires that the victim is running the mac-shell-mcp server (before 2.0.0) and that the attacker can submit requests to it as a connected MCP client - this includes a legitimate client being driven by a malicious or prompt-injected LLM. The specific prerequisite is the execute_command tool's whitelist-based validation, which checks only the base command name while passing attacker-controlled arguments to a shell, so any allowed command (e.g., pwd) plus shell metacharacters (';', '&&', '|', '$()') in the arguments triggers it. Limiting factors: the attacker must already have MCP client-level access (PR:L, local vector AV:L), so this is not a remote-unauthenticated internet-facing flaw; impact is bounded by the privileges of the server user; and installations upgraded to 2.0.0 or later are not affected.

This is a genuine, well-substantiated command injection flaw (CWE-78) rather than an inflated high-CVSS score. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 8.5 High) indicates a local attack vector with low attack complexity, requiring only low privileges and no user interaction, yielding total confidentiality/integrity/availability loss on the vulnerable system with no subsequent-system scope change. The attack vector is local because exploitation flows through an MCP client already connected to the server, and PR:L reflects that the attacker must be an authorized MCP client/prompt rather than a wholly unauthenticated outsider. No EPSS score is provided, the CVE is NOT listed in CISA KEV, and no public exploit/POC repository is referenced, so there is no public exploit identified at time of analysis - though the description itself supplies a trivially reproducible technique (calling an allowed command like pwd with an argument of ';'). The signals are internally consistent: moderate-to-high technical severity, easy to trigger once you can talk to the server, but no evidence of widespread or active exploitation. The practical priority is elevated for anyone running this specific MCP server, especially given the emerging threat model where a malicious or hijacked prompt - not just a human attacker - can trigger the injection, but the overall real-world footprint is small.

An attacker (or a malicious/poisoned prompt driving an MCP client) invokes a whitelisted command such as execute_command with name 'pwd' and supplies arguments containing shell metacharacters like ';' followed by a forbidden command. The whitelist check passes on the safe base command while the injected metacharacters cause the shell to execute arbitrary attacker-controlled commands as the server user, bypassing the approval mechanism. No public POC repository is referenced, but the CVE description provides a directly reproducible example.