Model Context Protocol

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser read the stop-parsing token (--%) differently than PowerShell does. If a user opens an attacker-prepared repository and Codex follows its instructions, Codex can run a file-writing Git command without requesting approval. If filesystem protections permit the write, the attacker can modify Codex's configuration so that a later load launches an attacker-controlled MCP server, executing code with the user's privileges.

MCPHub, a hub for managing and orchestrating multiple MCP servers and APIs, performs no role checking on its built-in prompt and resource controllers before version 1.0.32. Any authenticated non-admin user can call the mutating POST/PUT /api/prompts* and POST/PUT /api/resources* routes, creating, overwriting or shadowing global prompt templates and resources that are served to all users. Because these records are consulted before any connected MCP server, the tampering can also lead to prompt injection in other users' LLM sessions.

Chainlist, the Chainlit MCP server component, contains a blind SSRF (CVE-2026-45019) in the POST /mcp endpoint for the sse and streamable-http transports when features.mcp.enabled is true. The endpoint accepts an unvalidated, user-controlled url and headers dictionary, and passes them to the MCP SDK's sse_client() or streamablehttp_client(), letting an unauthenticated attacker make the server send requests with attacker-chosen headers such as Authorization and Cookie. Affected ranges are >=2.4.0rc0 for URL-based SSRF and >=2.6.4 for header forwarding, both before 2.12.0.

browse-mcp, an MCP server, has an arbitrary file write flaw in `browser_download`, `browser_save_state` and `browser_load_state`. Their `save_dir` and `path` arguments are not validated, so a caller controlling the MCP arguments can write attacker-supplied response bytes to any path the process can reach, such as `~/.bashrc` or a cron file, which can lead to host code execution. The `force_fetch` fallback also bypassed the `BROWSE_MCP_ALLOWED_ORIGINS` origin fence. The estimated CVSS 3.1 score is around 7.8 (High) for the local, agent-mediated case.

mcp-shell at commit 17ac0eef5c9a5a42b8fb132d3d034973d55a5433 ships with its security layer disabled: config.go sets SecurityConfig Enabled to false, and the from-source install path and MCP client example never set MCP_SHELL_SEC_CONFIG_FILE, so any connected LLM can call shell_exec with arbitrary commands. Separately, the official security.yaml baked into the Docker image lists /bin/bash and /usr/bin/python3 in allowed_executables, so secure mode can be bypassed by calling /bin/bash -i, which passes validation and yields an interactive shell.

mcp-shell's default Docker configuration (security.yaml) includes /bin/bash in allowed_executables, and the command validator in security.go checks only the first token, so it does not block shell flags such as -c. Any MCP tool caller can send command=/bin/bash -c <arbitrary-command> to shell_exec, with no authentication or configuration changes needed, and run binaries outside the allowlist as mcpuser inside the container.

mcp-shell's secure mode, which restricts execution to an allowlist defined in security.yaml, can be bypassed through the shell_exec MCP tool. The default allowlist includes /usr/bin/git, and the metacharacter validator in security.go omits the ! character, which Git uses for shell aliases, so passing /usr/bin/git -c alias.pwn=!<command> yields arbitrary OS command execution as the mcp-shell process user, with no authentication required in the default Docker deployment.

The PraisonAI MCP server's HTTP-stream transport, started with praisonai mcp serve --transport http-stream, validates Origin with a startswith prefix match against http://localhost and http://127.0.0.1. An attacker can therefore host a page on a hostname such as localhost.attacker.com, and when a victim visits it, the server accepts and executes unauthenticated cross-site requests, including a tools/call that creates a rule file with activation "always" to inject persistent prompt instructions into later agent runs. The request can be sent as a CORS simple request with Content-Type: text/plain, requiring no preflight, and no session is needed for tools/call. This is a blind CSRF against a local agent runtime.

CVE-2026-18482 is a command injection vulnerability in the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server in Neo.mjs. The checkSyntax() and runPlaywrightTest() functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS command execution when an AI agent is induced to invoke these tools.

The export_space and import_space tools in @contentful/mcp-tools accept LLM-controlled host and proxy parameters and spread them unfiltered into the options passed to contentful-export and contentful-import. Those options, including the server's CMA Personal Access Token, reach the Contentful Management API client, which sends the token as a Bearer header to the attacker-supplied host. An attacker who can invoke MCP tools, or plant instructions in Contentful content the LLM reads, can redirect CMA requests and the PAT to an attacker-controlled endpoint.

claude-faf-mcp, an MCP server, resolves caller-supplied `path` arguments into filesystem reads and writes without confining them to a trusted project directory. A caller, or an LLM prompt-injected through attacker-controlled content, can read files such as SSH keys, cloud credentials and `.env` files, and `faf_write` can write outside the project.

faf-mcp versions before 2.1.3 accept a caller-controlled `path` argument in the shared `getProjectPath()` chokepoint and the `faf_read` and `faf_write` tools, resolving it without confinement to a project directory. An MCP client, or a prompt-injected LLM issuing a tool call, can read files such as SSH keys, cloud credentials and `.env` files, and `faf_write` can write outside the project (CWE-200).

grok-faf-mcp, an MCP server, has several FAF tools (refresh_faf, faf_score, faf_get_orchestration_policy, refresh_blend, faf_read, faf_write) that accept a caller-controlled path argument and read it without confinement to a trusted project directory. An MCP client, or an LLM prompt-injected through attacker-controlled content, can use absolute paths or ../ traversal to read files such as SSH keys, cloud credentials and .env files, with OS file permissions as the only remaining limit.