Description

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with_operators function when ALLOW_SHELL_OPERATORS is enabled. Attackers can use shell command substitution syntax like $(...) or backticks to execute non-allowlisted commands that bypass the ALLOWED_COMMANDS validation check.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-04T15:17:43.490Z",
  "pubdate": "2026-09-04T15:17:43.490Z",
  "executiveSummary": "The cli-mcp-server version 0.2.5 is affected by a command allowlist bypass vulnerability within the _validate_command_with_operators function. This vulnerability occurs when the ALLOW_SHELL_OPERATORS configuration is enabled, allowing an attacker to circumvent the security controls intended to restrict executable commands.\nThe flaw stems from an insufficient validation logic that fails to account for shell command substitution syntax. An attacker can leverage this oversight to execute arbitrary, non-allowlisted commands, effectively neutralizing the intended security boundary of the ALLOWED_COMMANDS list.\nThe impact includes potential unauthorized code execution, system manipulation, and potential data exfiltration, depending on the privileges of the underlying process. Exploitation requires the attacker to have the ability to influence input provided to the command execution interface of the server. The vulnerability presents a significant risk to systems relying on cli-mcp-server for secure command management, as it undermines the core integrity of the command execution policy.",
  "technicalDetails": "The root cause of the vulnerability resides in the implementation of the _validate_command_with_operators function in cli-mcp-server 0.2.5. When ALLOW_SHELL_OPERATORS is configured as enabled, the application attempts to permit the use of shell-specific operators by allowing them within the input string; however, the validation logic fails to sanitize or properly restrict the entire command string against the ALLOWED_COMMANDS whitelist.\nSpecifically, the input validation process is susceptible to shell command substitution mechanisms, such as $(...) or backticks (`...`). When a user inputs a command, the function performs a check against the whitelist. If shell operators are enabled, the code permits the inclusion of these operators without verifying the inner content of the substituted command string.\nThe attack flow follows a structured exploitation path: First, the attacker crafts a malicious input string that embeds an unauthorized, sensitive command inside a shell substitution operator, for example: 'trusted_command $(malicious_command)'. Second, this payload is sent to the cli-mcp-server's command execution interface. Third, the _validate_command_with_operators function processes the string. Because the outer structure contains expected characters, the whitelist validation may incorrectly pass the input.\nOnce the input passes the validation gate, the underlying shell interprets the command string. The shell executes the outer 'trusted_command', but during the process, it encounters the substitution syntax and executes the 'malicious_command' with the same privileges as the parent server process. This results in the execution of commands that were explicitly restricted by the system administrator.\nThis vulnerability is not limited to simple command execution; it allows for recursive command injection, which can lead to post-exploitation actions such as privilege escalation, lateral movement within the environment, or the extraction of environment variables and sensitive configuration files. The vulnerability is triggered whenever the server attempts to process user-supplied input through a shell-enabled environment, bypassing the intended security policy entirely."
}