CVE-2026-55581

Name of the Vulnerable Software and Affected Versions mcp-shell versions prior to 0.6.0

Description An OS command injection issue exists in the shell exec MCP tool. The software implements a secure mode that restricts command execution to an allowlist defined in security.yaml. However, the default Docker configuration includes /bin/bash in the allowed executables list. The validation logic in security.go only verifies the first token of the command and fails to reject the shell command-mode flag -c.

An attacker can bypass the allowlist by providing a command such as /bin/bash -c <arbitrary-command> to the shell exec tool. This input passes validation and is executed via exec.CommandContext in executor.go, allowing arbitrary OS command execution inside the container as the mcpuser user. This bypass requires no authentication or configuration changes.

Recommendations Update mcp-shell to version 0.6.0. As a temporary mitigation, remove /bin/bash from the allowed executables list in the security.yaml configuration file.