CVE-2026-55582

Name of the Vulnerable Software and Affected Versions mcp-shell versions prior to 0.6.0

Description An OS Command Injection issue exists in the shell exec MCP tool. The software implements a secure mode that restricts command execution to an allowlist of executables defined in security.yaml, which by default includes /usr/bin/git. However, the security validator in security.go fails to block the ! character in the containsShellMetacharacters() and containsDangerousShellConstructs() functions. An attacker can exploit this by providing a command argument such as /usr/bin/git -c alias.pwn=!<arbitrary-command>, which leverages Git's ability to create shell aliases to execute arbitrary OS commands as the mcp-shell process user. In default Docker deployments, this is exploitable without additional authentication beyond MCP connectivity.

Recommendations Update mcp-shell to version 0.6.0. As a temporary workaround, remove /usr/bin/git from the allowed executables list in security.yaml or restrict access to the shell exec tool.