GPU VulnDB

Database/AI/ML frameworks & serving

mcp-shell: allowed git binary runs arbitrary commands via a `!` alias, bypassing secure mode

CVSS 8.4CVE-2026-55582AI/ML frameworks & servingcurated

Impact

The default policy allows /usr/bin/git, and the metacharacter checks omit !, with no per-executable argument policy. git -c alias.pwn=!<command> therefore defines a shell alias and executes arbitrary OS commands as the mcp-shell process user. The advisory is explicit that the default Docker image - mcpuser, git installed, secure mode enabled - is exploitable as shipped, so this is not a misconfiguration case. Second bypass of the same allowlist as CVE-2026-55581 and fixed by the same commit, which is the useful signal: treat pre-0.6.0 shell_exec as unbounded command execution rather than patching individual escapes.

Who can reach it

Any caller who can invoke the shell_exec MCP tool. No authentication beyond MCP connectivity in the default deployment.

What to do

Upgrade to mcp-shell 0.6.0 and restart the server; for Docker, repull or rebuild the image and restart the container. Removing git from allowed_executables closes this specific path but not the class - do not treat it as a substitute for the upgrade. Fixed in commit f31377f (PR #16).

References

https://nvd.nist.gov/vuln/detail/CVE-2026-55582https://github.com/sonirico/mcp-shell/security/advisories/GHSA-74hp-mggr-hv58https://github.com/sonirico/mcp-shell/commit/f31377fce6ec31114e5a4398c0e5270552bce09fhttps://github.com/sonirico/mcp-shell/releases/tag/v0.6.0

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.