Cli-Mcp-Server (0.2.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/cli-mcp-server-0.2.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 04 Sep 2026 15:28:40 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCommand Allowlist Bypass in cli-mcp-serverhttps://feed.craftedsignal.io/briefs/2026-09-cli-mcp-server-bypass/Fri, 04 Sep 2026 15:28:40 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cli-mcp-server-bypass/The cli-mcp-server package version 0.2.5 contains a vulnerability in the _validate_command_with_operators function allowing attackers to bypass command allowlists via shell substitution.The cli-mcp-server package version 0.2.5 contains a vulnerability in the _validate_command_with_operators function that can be triggered when the ALLOW_SHELL_OPERATORS configuration is enabled. This flaw allows an attacker to bypass the defined ALLOWED_COMMANDS validation check by leveraging shell command substitution syntax, such as $(...) or backticks. When an attacker provides a crafted input string containing these shell metacharacters, the validation logic fails to correctly filter the command execution, leading to the execution of non-allowlisted and potentially malicious commands. This vulnerability highlights a failure in input sanitization within the server's command processing logic, posing a significant risk for systems that rely on this package to restrict command execution environments. Defenders should identify instances of cli-mcp-server and ensure they are updated to a non-vulnerable version, or disable the ALLOW_SHELL_OPERATORS feature if command execution flexibility is not required.

Impact

Successful exploitation allows for the execution of arbitrary, non-allowlisted shell commands, potentially leading to unauthorized system access, data exfiltration, or further lateral movement depending on the privileges of the process hosting the cli-mcp-server.

Recommendation

  • Identify and audit all applications currently using cli-mcp-server version 0.2.5.
  • Update cli-mcp-server to a version that patches the _validate_command_with_operators validation logic.
  • If an update is not immediately feasible, set ALLOW_SHELL_OPERATORS to false to mitigate the specific bypass vector.
]]>highadvisoryvulnerabilitycommand-injectionexecution