GHSA-f5pj-2738-996m: mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist

Summary

mcp-shell at commit 17ac0eef5c9a5a42b8fb132d3d034973d55a5433 ships with its security layer disabled: config.go sets SecurityConfig Enabled to false, and the from-source install path and MCP client example never set MCP_SHELL_SEC_CONFIG_FILE, so any connected LLM can call shell_exec with arbitrary commands. Separately, the official security.yaml baked into the Docker image lists /bin/bash and /usr/bin/python3 in allowed_executables, so secure mode can be bypassed by calling /bin/bash -i, which passes validation and yields an interactive shell.

Mitigation

Flip the default to SecurityConfig{Enabled: true}, making secure mode the operating default, and keep unrestricted mode behind an affirmative opt-in flag or environment variable such as --allow-unsafe.

Topics

• Model Context Protocol

Related items

• MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
• HighCVE-2026-122135: Mistral Vibe remote code execution via repository gpg.program settingSimilar attack · NVD/CVE Database
• HighCVE-2026-122134: Mistral Vibe remote code execution through malicious Git filter driversSimilar attack · NVD/CVE Database
• HighCVE-2026-122133: Mistral Vibe untrusted search path code execution via git.exe on WindowsSimilar attack · NVD/CVE Database
• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database