{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amac-shell-mcpmac-shell-mcp/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mac-shell-mcp:mac-shell-mcp:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-108953"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mac-shell-mcp (\u003c 2.0.0)"],"_cs_severities":["high"],"_cs_tags":["injection","rce","mcp","mac-shell-mcp"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe mac-shell-mcp library, used for Model Context Protocol (MCP) interactions, contains a critical OS command injection vulnerability identified as CVE-2026-108953. This vulnerability exists in versions prior to 2.0.0 and stems from improper sanitization of arguments passed to the execute_command function. MCP clients, which rely on this server component to execute shell commands, can be coerced by malicious prompts to execute unauthorized commands. An attacker can inject shell metacharacters, such as semicolons, into arguments intended for approved commands (e.g., pwd), effectively bypassing the established command whitelist. Successful exploitation results in arbitrary code execution with the permissions of the user running the MCP server process, posing a significant risk in environments where LLMs or external agents interact with local system resources.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the host machine running the mac-shell-mcp server. This can lead to full system compromise, data exfiltration, or the establishment of persistent backdoors depending on the privileges assigned to the user running the service. The vulnerability affects all deployments of mac-shell-mcp version 2.0.0 and earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade mac-shell-mcp to version 2.0.0 or later immediately to patch the vulnerable execute_command input sanitization logic.\u003c/li\u003e\n\u003cli\u003eReview all MCP server implementations for exposure to untrusted user input or external prompt injections that might invoke local shell commands.\u003c/li\u003e\n\u003cli\u003eEnsure the user account running the MCP server has the principle of least privilege applied, restricting its ability to modify system-level files or reach sensitive data.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T13:43:09Z","date_published":"2026-10-12T13:43:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mac-shell-mcp-injection/","summary":"The mac-shell-mcp package before version 2.0.0 is vulnerable to OS command injection via malicious prompt manipulation of execute_command arguments, allowing unauthorized code execution.","title":"CVE-2026-108953: OS Command Injection in mac-shell-mcp","url":"https://feed.craftedsignal.io/briefs/2026-10-mac-shell-mcp-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:mac-Shell-Mcp:mac-Shell-Mcp:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}