Neo Mjs
Monthly
Arbitrary OS command execution in Neo.mjs (versions prior to commit 88c77fc4) arises in the ai/mcp/server/file-system MCP server, whose FileSystemService.mjs passes a caller-supplied absolutePath into a shell via exec() inside checkSyntax() and runPlaywrightTest(). An attacker who can steer an AI agent into calling these MCP tools with a path containing shell metacharacters runs commands with the privileges of the MCP server process. No public exploit is identified at time of analysis and the flaw is not in CISA KEV; EPSS is low (0.75%), consistent with a niche, agent-invoked attack surface rather than mass exploitation.
Arbitrary OS command execution in Neo.mjs (versions prior to commit 88c77fc4) arises in the ai/mcp/server/file-system MCP server, whose FileSystemService.mjs passes a caller-supplied absolutePath into a shell via exec() inside checkSyntax() and runPlaywrightTest(). An attacker who can steer an AI agent into calling these MCP tools with a path containing shell metacharacters runs commands with the privileges of the MCP server process. No public exploit is identified at time of analysis and the flaw is not in CISA KEV; EPSS is low (0.75%), consistent with a niche, agent-invoked attack surface rather than mass exploitation.