CVE-2026-55580

Name of the Vulnerable Software and Affected Versions mcp-shell versions prior to 0.6.0

Description The software contains two security flaws that allow unrestricted operating system command execution. First, the security configuration is disabled by default when the MCP SHELL SEC CONFIG FILE environment variable is unset, causing the validateCommand() function in security.go to allow all commands passed to the shell exec MCP tool. Second, the default security.yaml configuration used in Docker images includes shell interpreters such as /bin/bash and /usr/bin/python3 in the allowed executables list. This allows an attacker or a compromised LLM to bypass metacharacter filtering by executing commands through these interpreters, effectively granting full shell access within the environment. The attack vector involves prompt injection or poisoned tool descriptions, enabling the execution of arbitrary commands as the user running the mcp-shell process.

Recommendations Update to version 0.6.0. As a temporary mitigation, ensure the MCP SHELL SEC CONFIG FILE environment variable is explicitly set to a valid security configuration file. Remove shell interpreters like /bin/bash, /bin/sh, and /usr/bin/python3 from the allowed executables list in the security.yaml configuration file.