OS Command Injection in token-optimizer-mcp via smart_user

The @ooples/token-optimizer-mcp package (versions prior to 5.1.0) contains an OS command injection vulnerability within the smart_user tool's get-user-info operation. The application insecurely interpolates the user-provided username argument directly into a shell command string that is subsequently executed using execAsync().

The implementation uses the pattern getent passwd "${username}" || grep "^${username}:" /etc/passwd. Because POSIX shells evaluate command substitution syntax such as $(...) and backticks even when enclosed in double quotes, the application fails to sanitize malicious inputs. An attacker capable of invoking the smart_user tool through an MCP client can inject shell metacharacters to execute arbitrary commands with the identity and permissions of the process running the MCP server. This vulnerability, identified as CVE-2026-55157, poses a significant risk to the integrity and confidentiality of the host environment.

Attack Chain

1. An attacker gains access to an MCP client that can interact with the token-optimizer-mcp server.
2. The attacker identifies the smart_user tool as a potential vector for interaction with the operating system.
3. The attacker crafts a malicious JSON-RPC request for the tools/call method targeting the smart_user tool.
4. The username argument is populated with an injection payload, such as $(id > /tmp/pwned).
5. The MCP server receives the request and passes the malicious string into the get-user-info tool implementation.
6. The execAsync() function executes the shell command containing the attacker-controlled payload.
7. The POSIX shell parses the command substitution inside the double quotes, triggering the execution of the injected command.
8. The injected command runs with the privileges of the MCP server, potentially leading to system compromise or data exfiltration.

Impact

Successful exploitation allows for arbitrary code execution with the privileges of the user running the MCP server process. This can lead to unauthorized access to system resources, potential lateral movement, and the execution of malicious tasks such as file creation or data exfiltration. The vulnerability impacts all environments where @ooples/token-optimizer-mcp version 5.0.1 or earlier is deployed.

Recommendation

1. Upgrade @ooples/token-optimizer-mcp to version 5.1.0 or later immediately to patch CVE-2026-55157.
2. Implement input validation and sanitization for all user-supplied arguments passed to shell execution functions.
3. Replace calls to shell-interpreting functions like execAsync() with safer alternatives that do not invoke a shell (e.g., using execFile() with distinct argument arrays).
4. Deploy the suggested Sigma rule to monitor for child processes spawned by the MCP server process.