HighVulnerability

GHSA-74hp-mggr-hv58: mcp-shell has a Secure Mode Allowlist Bypass via Git Shell Alias

Source: GitHub Advisory(opens in a new tab)
Identifiers: CVE-2026-55582GHSA-74hp-mggr-hv58
Published: August 25, 2026
Record updated: October 9, 2026

Affected: github.com/sonirico/mcp-shell < 0.6.0
Fixed in: 0.6.0
released June 14, 2026, 72 days before disclosure
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.3%

Summary

mcp-shell's secure mode, which restricts execution to an allowlist defined in security.yaml, can be bypassed through the shell_exec MCP tool. The default allowlist includes /usr/bin/git, and the metacharacter validator in security.go omits the ! character, which Git uses for shell aliases, so passing /usr/bin/git -c alias.pwn=!<command> yields arbitrary OS command execution as the mcp-shell process user, with no authentication required in the default Docker deployment.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Details

Scores and exploitation

Patch available: Yes
EPSS: 0.3%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on November 4, 2026.
Disclosure date: August 25, 2026

Affected

Packages: github.com/sonirico/mcp-shell@< 0.6.0 (fixed: 0.6.0)

Classification

Attack type: Other
Attack sophistication: Trivial
AI component targeted: Agent
Impact: Confidentiality,
Integrity,
Availability
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative.

Original source: https://github.com/advisories/GHSA-74hp-mggr-hv58

First tracked: August 25, 2026 at 02:01 PM ET, from GitHub Advisory Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 90% (self-assessed)

Topics

Model Context Protocol

Summary

Mitigation

Topics

Related items