Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
mcp-shell at commit 17ac0eef5c9a5a42b8fb132d3d034973d55a5433 has two issues that together mean neither the default deploy path nor the recommended "secure mode" delivers the restriction they're marketed as providing. Filing these together because the two failure modes bracket the full intended audience — the from-source path gets users who skip security config entirely, the Docker path gets users who follow the security.yaml example and believe they're protected. --- The first issue is in config.go, line 49: Security is opt-in. The bare binary ships with Enabled: false, and security.go lines 26–29 make the consequence explicit: main.go lines 35–39 confirm the deployment condition: The README's from-source install path (lines 22–26) runs git clone ... && make install && mcp-shell with no environment variable and no config file. The MCP client config example block (lines 78–85) passes only MCPSHELLLOGLEVEL — no MCPSHELLSECCONFIGFILE. Every operator who follows either documented path…
Recommended action: Upgrade to 0.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
mcp-shell ships a default Docker configuration (security.yaml) that includes /bin/bash in the allowedexecutables allowlist. The command validator (security.go) only checks whether the first token of the supplied command matches an allowed executable; it does not inspect or reject shell command-mode flags such as -c. As a result, any MCP tool caller can send command=/bin/bash -c <arbitrary-command to the shellexec tool and execute commands that are not in the allowlist — including id, env, curl, wget, and any other binary present in the container. The bypass works with the default Docker image, requires no authentication, and requires no modifications to server configuration. Successful exploitation gives the attacker arbitrary OS command execution inside the container as mcpuser. Details mcp-shell implements a secure mode in which command execution is restricted to an explicit allowlist of executables defined in security.yaml. The Docker image ships this file with the…
Recommended action: Upgrade to 0.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
mcp-shell's "secure mode" is designed to restrict command execution to an allowlist of executables defined in security.yaml. The default configuration includes /usr/bin/git. The security validator in security.go blocks common shell metacharacters (|&;<(){}[]$\) but omits !, which is the prefix Git uses to execute shell aliases (alias.NAME=!CMD). An attacker who can invoke the shellexec MCP tool can pass /usr/bin/git -c alias.pwn=!<arbitrary-command as the command argument, bypassing all validation and achieving arbitrary OS command execution as the mcp-shell process user. The default Docker image runs as mcpuser (UID 1000) with Git installed and secure mode enabled, making this exploitable in the default deployment with no authentication required. Details The vulnerability is a classic OS Command Injection (CWE-78) in the shellexec MCP tool handler. The data flow from attacker input to shell execution is: 1. main.go:89-91 — The MCP tool schema exposes a required string…
Recommended action: Upgrade to 0.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.