mcp-shell: allowed git binary runs arbitrary commands via a `!` alias, bypassing secure mode

Impact

The default policy allows /usr/bin/git, and the metacharacter checks omit !, with no per-executable argument policy. git -c alias.pwn=!<command> therefore defines a shell alias and executes arbitrary OS commands as the mcp-shell process user. The advisory is explicit that the default Docker image - mcpuser, git installed, secure mode enabled - is exploitable as shipped, so this is not a misconfiguration case. Second bypass of the same allowlist as CVE-2026-55581 and fixed by the same commit, which is the useful signal: treat pre-0.6.0 shell_exec as unbounded command execution rather than patching individual escapes.

Who can reach it

Any caller who can invoke the shell_exec MCP tool. No authentication beyond MCP connectivity in the default deployment.

What to do

Upgrade to mcp-shell 0.6.0 and restart the server; for Docker, repull or rebuild the image and restart the container. Removing git from allowed_executables closes this specific path but not the class - do not treat it as a substitute for the upgrade. Fixed in commit f31377f (PR #16).

References

Related entries

• Gradio: CORS origin validation bypassCVE-2024-47084 · GradioHigh
• Dagster: Vulnerability in Dagster Core prior to 1.13.1CVE-2026-41490 · DagsterHigh
• TorchServe (gRPC 7070/7071): gRPC ports bound to all interfaces regardless of configCVE-2024-35199 · TorchServe (gRPC 7070/7071)High
• Ollama (GGUF parser): Malformed 4-byte GGUF file crashes the server (two HTTP requests)CVE-2024-39720 · Ollama (GGUF parser)High
• Docker Model Runner (vllm-metal backend): `trust_remote_code=True` set unconditionally, no sandboxCVE-2026-5817 · Docker Model Runner (vllm-metal backend)High
• Gradio: Command injectionCVE-2023-6572 · GradioHigh