Description

mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into execute_command arguments. Attackers or malicious prompts can call a safe command such as pwd with arguments like ';' to run forbidden commands as the server user without approval.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-10-12T13:17:28.307Z",
  "pubdate": "2026-10-12T13:17:28.307Z",
  "executiveSummary": "The mac-shell-mcp package, in versions prior to 2.0.0, is susceptible to an OS command injection vulnerability. This flaw arises from insufficient sanitization of arguments passed to the execute_command function, enabling an attacker to escape the defined command whitelist.\nBy injecting shell metacharacters, a malicious actor or a deceptive prompt can subvert the intended functionality of the MCP (Model Context Protocol) server. This allows for the execution of arbitrary commands with the privileges of the system user running the server process.\nThe impact is significant, as it effectively bypasses security controls designed to restrict server-side execution. An attacker capable of interacting with the MCP client can achieve unauthorized remote code execution, potentially leading to full system compromise, lateral movement, or unauthorized data access. No specific authentication is required if the MCP server is exposed to the malicious input vector. Users are advised to upgrade to version 2.0.0 or later to address the underlying sanitization flaw.",
  "technicalDetails": "The vulnerability resides within the argument handling logic of the execute_command function in mac-shell-mcp. The component utilizes a whitelist-based approach to restrict the commands that an MCP client can invoke on the host system. However, the implementation fails to properly escape or sanitize arguments before they are passed to the underlying shell environment.\nThe root cause is an improper neutralization of special elements used in an OS command. Specifically, the software does not account for shell metacharacters—such as semicolons (;), pipes (|), or backticks (`)—within the argument payload. Because the input is directly concatenated or passed to a command-line interface that evaluates shell syntax, the application is susceptible to command chaining.\nThe exploitation flow proceeds as follows: An attacker sends a specially crafted request through the MCP client to the mac-shell-mcp server. The request invokes a seemingly 'safe' command that exists within the server's whitelist, such as 'pwd'. By appending shell metacharacters and a secondary, malicious command (e.g., 'pwd; rm -rf /'), the attacker forces the shell to interpret the first command as the intended operation, followed immediately by the execution of the unauthorized payload.\nBecause the server process executes the resultant command string as the current user, the injected command inherits the permissions of the server instance. This bypasses the security intent of the whitelist, as the shell interpreter treats the injected metacharacters as command separators rather than literal string arguments. This behavior is indicative of a lack of proper shell argument handling, such as using array-based execution (execvp style) which prevents shell expansion, or failing to validate the input against a strict regex or character set that denies metacharacters.\nAffected versions include all releases of mac-shell-mcp prior to 2.0.0. The exploit does not require specialized network access beyond the ability to reach the MCP client/server interface, nor does it require prior authentication if the interface is improperly secured or accessed via untrusted LLM-generated prompts. Post-exploitation impact includes full control over the execution context, potential persistence, and access to sensitive files or environmental variables accessible to the host user."
}