x/vulndb: potential Go vuln in github.com/sonirico/mcp-shell: GHSA-f5pj-2738-996m

[GoVulnBot]

Advisory GHSA-f5pj-2738-996m references a vulnerability in the following Go modules:

Module
github.com/sonirico/mcp-shell

Description:
mcp-shellat commit17ac0eef5c9a5a42b8fb132d3d034973d55a5433` has two issues that together mean neither the default deploy path nor the recommended "secure mode" delivers the restriction they're marketed as providing. Filing these together because the two failure modes bracket the full intended audience — the from-source path gets users who skip security config entirely, the Docker path gets users who follow the security.yaml example and believe they're protected.

---

The first issue is in config.go, line 49:

config := &Config{
    Security: SecurityConfig{
        Enabled: fals...

References:
- ADVISORY: https://github.com/advisories/GHSA-f5pj-2738-996m
- ADVISORY: https://github.com/sonirico/mcp-shell/security/advisories/GHSA-f5pj-2738-996m
- FIX: https://github.com/sonirico/mcp-shell/commit/f31377fce6ec31114e5a4398c0e5270552bce09f
- FIX: https://github.com/sonirico/mcp-shell/pull/16
- WEB: https://github.com/sonirico/mcp-shell/releases/tag/v0.6.0

No existing reports found with this module or alias.
See [doc/quickstart.md](https://github.com/golang/vulndb/blob/master/doc/quickstart.md) for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
- module: github.com/sonirico/mcp-shell
versions:
- fixed: 0.6.0
vulnerable_at: 0.5.0
summary: |-
mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell
Interpreter in Secure-Mode Allowlist in github.com/sonirico/mcp-shell
cves:
- CVE-2026-55580
ghsas:
- GHSA-f5pj-2738-996m
references:
- advisory: GHSA-f5pj-2738-996m
- advisory: GHSA-f5pj-2738-996m
- fix: sonirico/mcp-shell@f31377f
- fix: sonirico/mcp-shell#16
- web: https://github.com/sonirico/mcp-shell/releases/tag/v0.6.0
source:
id: GHSA-f5pj-2738-996m
created: 2026-08-25T16:02:17.60747484Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/821520 mentions this issue: data/reports: add 27 reports

[gopherbot]

Change https://go.dev/cl/821820 mentions this issue: data/reports: add 4 reports