Mac Shell Mcp
Monthly
OS command injection in mac-shell-mcp before 2.0.0 lets a connected MCP client - including a legitimate client driven by a malicious or prompt-injected LLM - escape the tool's command whitelist by appending shell metacharacters to the arguments of an otherwise permitted command such as pwd, causing forbidden commands to run as the server user without approval. Exploitation requires an existing MCP client session to the local server (CVSS 4.0 vector AV:L/PR:L/UI:N, mirroring the independent CVSS 3.1 assessment AV:L/PR:L/UI:N with high confidentiality, integrity and availability impact), so this is an authenticated, locally-scoped flaw rather than an internet-facing unauthenticated one, and impact is bounded by the privileges of the account the server runs under. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but a vendor fix and upstream patch commit are available; EPSS data was not provided for this CVE.
OS command injection in mac-shell-mcp before 2.0.0 lets a connected MCP client - including a legitimate client driven by a malicious or prompt-injected LLM - escape the tool's command whitelist by appending shell metacharacters to the arguments of an otherwise permitted command such as pwd, causing forbidden commands to run as the server user without approval. Exploitation requires an existing MCP client session to the local server (CVSS 4.0 vector AV:L/PR:L/UI:N, mirroring the independent CVSS 3.1 assessment AV:L/PR:L/UI:N with high confidentiality, integrity and availability impact), so this is an authenticated, locally-scoped flaw rather than an internet-facing unauthenticated one, and impact is bounded by the privileges of the account the server runs under. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but a vendor fix and upstream patch commit are available; EPSS data was not provided for this CVE.