Database/AI/ML frameworks & serving
mcp-shell: allowlist validates only the first token, so /bin/bash -c runs any command
Impact
mcp-shell's whole security proposition is that shell_exec only runs binaries on an allowlist. Validation looks at the first token and the blocked-pattern check does not reject bash's -c flag, so /bin/bash -c <anything> passes the allowlist and then executes as the mcp-shell process user. In the shipped Docker image that is mcpuser inside the container, so the immediate blast radius is the container and whatever it mounts - source trees, credentials, kubeconfig, model directories that agent tooling is typically given. Anyone who can reach the MCP endpoint gets that; the allowlist provides no containment at all until 0.6.0.
Who can reach it
Any caller who can invoke the shell_exec MCP tool. No authentication beyond MCP connectivity is required in the default deployment, so exposure is exactly the set of clients and agents that can reach the server.
What to do
Upgrade to mcp-shell 0.6.0 and restart the server; for the Docker deployment, rebuild or repull the image and restart the container. Until then, remove /bin/bash from allowed_executables in security.yaml and restrict network access to the MCP endpoint. Fixed in commit f31377f (PR #16).
References
Related entries
- mcp-shell: allowed git binary runs arbitrary commands via a `!` alias, bypassing secure modeCVE-2026-55582 · mcp-shell (security.go shell-metacharacter checks, git alias handling)High
- Eclipse Che: authenticated SSRF in devfile URL fetching leaks the pod service-account tokenCVE-2026-86671 · Eclipse Che (URLFetcher in /api/scm/resolve and /api/factory/resolver)High
- Gradio: CORS origin validation bypassCVE-2024-47084 · GradioHigh
- vLLM: malformed multimodal embedding input crashes the engine and drops every in-flight requestCVE-2025-62372 · vLLM (multimodal embedding input validation)High
- LangChain: template injection in prompt templates exposes Python object internalsCVE-2025-65106 · LangChain ChatPromptTemplate (prompt template parsing)High
- vLLM: --revision pin ignored for some FunAudioChat and Tarsier2 processor, tokenizer and config loadsCVE-2026-100653 · vLLM (revision pin not propagated to FunAudioChat and Tarsier2 Hugging Face artifact loads)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.