Advisory GHSA-3x77-wg38-92r3 references a vulnerability in the following Go modules:
Description:
Summary
mcp-shell ships a default Docker configuration (security.yaml) that includes /bin/bash in the allowed_executables allowlist. The command validator (security.go) only checks whether the first token of the supplied command matches an allowed executable; it does not inspect or reject shell command-mode flags such as -c. As a result, any MCP tool caller can send command=/bin/bash -c <arbitrary-command> to the shell_exec tool and execute commands that are not in the allowlist — including id, env, curl, wget, and any other binary present in the container. The b...
References:
No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.
id: GO-ID-PENDING
modules:
- module: github.com/sonirico/mcp-shell
versions:
- fixed: 0.6.0
vulnerable_at: 0.5.0
summary: mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` Executable in github.com/sonirico/mcp-shell
cves:
- CVE-2026-55581
ghsas:
- GHSA-3x77-wg38-92r3
references:
- advisory: https://github.com/advisories/GHSA-3x77-wg38-92r3
- advisory: https://github.com/sonirico/mcp-shell/security/advisories/GHSA-3x77-wg38-92r3
- fix: https://github.com/sonirico/mcp-shell/commit/f31377fce6ec31114e5a4398c0e5270552bce09f
- fix: https://github.com/sonirico/mcp-shell/pull/16
- web: https://github.com/sonirico/mcp-shell/releases/tag/v0.6.0
source:
id: GHSA-3x77-wg38-92r3
created: 2026-08-25T16:02:16.048106843Z
review_status: UNREVIEWED
Advisory GHSA-3x77-wg38-92r3 references a vulnerability in the following Go modules:
Description:
Summary
mcp-shellships a default Docker configuration (security.yaml) that includes/bin/bashin theallowed_executablesallowlist. The command validator (security.go) only checks whether the first token of the supplied command matches an allowed executable; it does not inspect or reject shell command-mode flags such as-c. As a result, any MCP tool caller can sendcommand=/bin/bash -c <arbitrary-command>to theshell_exectool and execute commands that are not in the allowlist — includingid,env,curl,wget, and any other binary present in the container. The b...References:
No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.