AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-f5pj-2738-996m: mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist

highvulnerabilityLLM-Specific

security

Source: GitHub Advisory DatabaseAugust 25, 2026CVE-2026-55580

Summary

mcp-shell has two security flaws that disable protections in both deployment methods. By default, security is turned off (opt-in instead of opt-out), so users following the standard installation instructions run an unrestricted shell server where any connected LLM can execute arbitrary commands through prompt injection. Additionally, even Docker users who enable "secure mode" can bypass it by calling allowed programs like bash or python with flags that create interactive shells, giving the LLM direct command execution.

Solution / Mitigation

The source explicitly recommends: flip the default to enable security by default, with an `--allow-unsafe` flag (or equivalent environment variable) requiring explicit opt-in for unrestricted mode. Additionally, the allowed executables list should be reviewed to prevent shell interpreters like `/bin/bash` and `/usr/bin/python3` from being in the allowlist in secure mode, since they can be invoked with flags that bypass metac character restrictions.