EUVD-2026-65550
GHSA-f5pj-2738-996m
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stdio transport gives AV:L; LLM client needs no OS privileges (PR:N); arbitrary shell execution escapes the tool scope, giving S:C with full C/I/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, config.go initializes Security.Enabled to false, and when MCP_SHELL_SEC_CONFIG_FILE is unset, main.go starts the documented bare-binary deployment without a security policy. SecurityValidator.validateCommand in security.go then short-circuits and allows every command supplied to the shell_exec MCP tool, so an LLM connected over stdio can execute unrestricted OS commands as the mcp-shell process user. The README from-source installation and MCP client configuration omit MCP_SHELL_SEC_CONFIG_FILE, making the insecure state the documented default. This issue is fixed in version 0.6.0.
AnalysisAI
Unrestricted OS command execution in mcp-shell prior to v0.6.0 allows any LLM connected via stdio to invoke the shell_exec tool with arbitrary command strings, running them as the mcp-shell process user with no filtering, allowlisting, or logging. The root cause is that config.go initializes SecurityConfig.Enabled to false and SecurityValidator.validateCommand unconditionally short-circuits when that flag is false, bypassing all CWE-78-class protections. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires mcp-shell version prior to v0.6.0 running without MCP_SHELL_SEC_CONFIG_FILE set - the exact state produced by following either the from-source installation path or the MCP client configuration example in the README verbatim. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.6 (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) correctly captures the local attack vector - exploitation requires a locally connected LLM client rather than a remote network attacker - which bounds the exposed population to operators actively running agentic AI pipelines. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to mcp-shell v0.6.0, which makes secure mode the operating default - the server now boots restricted to a narrow allowlist of read-only utilities (ls, cat, grep, find, head, tail, wc, sort, uniq, pwd, whoami, date, echo) with UseShellExecution disabled and a 30-second execution timeout. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of mcp-shell currently deployed, particularly development and production systems with LLM integrations, and document their security configuration status. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today