{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mcp-shell/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mcp-shell"],"_cs_severities":["high"],"_cs_tags":["command-injection","mcp","container-security"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe mcp-shell utility, often deployed as an MCP (Model Context Protocol) tool, contains a critical security flaw in its secure mode validation logic. By default, the application ships with a \u003ccode\u003esecurity.yaml\u003c/code\u003e configuration that includes \u003ccode\u003e/bin/bash\u003c/code\u003e in its \u003ccode\u003eallowed_executables\u003c/code\u003e allowlist. The application's validation function, located in \u003ccode\u003esecurity.go\u003c/code\u003e, performs command authorization by splitting input strings on whitespace and evaluating only the first token (the executable) against the allowlist.\u003c/p\u003e\n\u003cp\u003eBecause the validator fails to inspect subsequent arguments or identify shell command-mode flags, an attacker can supply a command payload such as \u003ccode\u003e/bin/bash -c \u0026lt;arbitrary_command\u0026gt;\u003c/code\u003e. The application validates the first token (\u003ccode\u003e/bin/bash\u003c/code\u003e), confirms it is on the allowlist, and proceeds to execute the full command string via \u003ccode\u003eexec.CommandContext\u003c/code\u003e. This results in the execution of unapproved binaries and shell scripts within the container environment under the \u003ccode\u003emcpuser\u003c/code\u003e identity. The vulnerability is present in the official Docker image and requires no authentication or server configuration changes to exploit.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an MCP tool interface exposing the \u003ccode\u003eshell_exec\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eAttacker prepares a JSON-RPC request to the \u003ccode\u003etools/call\u003c/code\u003e method with \u003ccode\u003ename\u003c/code\u003e set to \u003ccode\u003eshell_exec\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker sets the \u003ccode\u003ecommand\u003c/code\u003e argument to \u003ccode\u003e/bin/bash -c \u0026lt;malicious_payload\u0026gt;\u003c/code\u003e (e.g., \u003ccode\u003e/bin/bash -c id\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe application receives the input in \u003ccode\u003ehandler.go\u003c/code\u003e and triggers the validation logic in \u003ccode\u003esecurity.go\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003esecurity.go\u003c/code\u003e splits the input string and identifies the executable as \u003ccode\u003e/bin/bash\u003c/code\u003e, which passes the allowlist check.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003echeckBlockedPatternsAndCommands\u003c/code\u003e function fails to identify the \u003ccode\u003e-c\u003c/code\u003e flag as a security risk, returning a successful validation state.\u003c/li\u003e\n\u003cli\u003eThe full command string is passed to \u003ccode\u003eexecutor.go\u003c/code\u003e, which invokes \u003ccode\u003eexec.CommandContext\u003c/code\u003e with the provided arguments.\u003c/li\u003e\n\u003cli\u003eThe container executes the malicious payload via the shell interpreter, granting the attacker arbitrary command execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary OS command execution (CWE-78) within the container's environment. Attackers can leverage the installed base of binaries (e.g., \u003ccode\u003ecurl\u003c/code\u003e, \u003ccode\u003ewget\u003c/code\u003e, \u003ccode\u003egrep\u003c/code\u003e, \u003ccode\u003esed\u003c/code\u003e) to perform data exfiltration, read sensitive files accessible to \u003ccode\u003emcpuser\u003c/code\u003e, modify the container's writable filesystem, or pivot to other network-accessible resources. The impact is elevated for production environments where these containers are used to bridge LLM agents with internal infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eRemove shell interpreters (e.g., \u003ccode\u003e/bin/bash\u003c/code\u003e, \u003ccode\u003e/bin/sh\u003c/code\u003e, \u003ccode\u003e/bin/dash\u003c/code\u003e) from the \u003ccode\u003eallowed_executables\u003c/code\u003e list in \u003ccode\u003esecurity.yaml\u003c/code\u003e to prevent command-mode injection.\u003c/li\u003e\n\u003cli\u003eImplement argument-level validation in \u003ccode\u003esecurity.go\u003c/code\u003e to explicitly deny common shell command-mode flags (such as \u003ccode\u003e-c\u003c/code\u003e) when a shell interpreter is used.\u003c/li\u003e\n\u003cli\u003eUpgrade to a patched version of \u003ccode\u003emcp-shell\u003c/code\u003e that incorporates regex-based argument validation for sensitive binaries.\u003c/li\u003e\n\u003cli\u003eReview and harden the container's entrypoint and environment variables to ensure that only the minimum necessary binaries are present in the runtime image.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-25T16:02:16Z","date_published":"2026-08-25T16:02:16Z","id":"https://feed.craftedsignal.io/briefs/2026-08-mcp-shell-bypass/","summary":"The mcp-shell tool contains a security bypass where improper validation of command-line arguments allows an attacker to execute arbitrary commands by leveraging a default-allowed shell interpreter.","title":"MCP-Shell Secure Mode Allowlist Bypass via Shell Interpreter","url":"https://feed.craftedsignal.io/briefs/2026-08-mcp-shell-bypass/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["mcp-shell"],"_cs_severities":["high"],"_cs_tags":["vulnerability","rce","mcp","llm-security"],"_cs_type":"advisory","_cs_vendors":["sonirico"],"content_html":"\u003cp\u003emcp-shell, a tool designed to provide shell execution capabilities to Large Language Models (LLMs) via the Model Context Protocol (MCP), contains two critical configuration flaws that negate its security controls. First, the application ships with security features disabled by default in \u003ccode\u003econfig.go\u003c/code\u003e. Unless an operator explicitly defines the \u003ccode\u003eMCP_SHELL_SEC_CONFIG_FILE\u003c/code\u003e environment variable, the \u003ccode\u003evalidateCommand\u003c/code\u003e function short-circuits and allows all incoming commands without restriction. Second, the default \u003ccode\u003esecurity.yaml\u003c/code\u003e configuration included in the Docker image provides an insecure allowlist containing shell interpreters such as \u003ccode\u003e/bin/bash\u003c/code\u003e and \u003ccode\u003e/usr/bin/python3\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThese flaws enable an LLM connected to the mcp-shell server to execute arbitrary commands on the underlying system. The attack surface is significant because mcp-shell operates via stdio transport; an attacker (or a compromised/misaligned LLM agent) can issue \u003ccode\u003eshell_exec\u003c/code\u003e calls that bypass validation either due to the \u0026quot;disabled by default\u0026quot; state or by abusing allowed interpreters to execute nested command strings, effectively bypassing metacharacter filters. These vulnerabilities affect all deployments prior to version 0.6.0, including source-based and official container-based installations.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe operator deploys mcp-shell using default installation steps (git clone or official Docker image).\u003c/li\u003e\n\u003cli\u003eThe operator fails to explicitly set the \u003ccode\u003eMCP_SHELL_SEC_CONFIG_FILE\u003c/code\u003e environment variable, leaving the security module in a disabled state (Finding 1) OR the operator uses the default \u003ccode\u003esecurity.yaml\u003c/code\u003e which permits shell interpreters (Finding 2).\u003c/li\u003e\n\u003cli\u003eThe attacker (e.g., a malicious or poisoned LLM) establishes a session with the mcp-shell server over the stdio transport.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a \u003ccode\u003etools/call\u003c/code\u003e request to the mcp-shell server specifying the \u003ccode\u003eshell_exec\u003c/code\u003e method.\u003c/li\u003e\n\u003cli\u003eThe server process receives the command request; if security is disabled, it proceeds directly to system execution.\u003c/li\u003e\n\u003cli\u003eIf in \u0026quot;secure mode\u0026quot; with an insecure allowlist, the attacker executes \u003ccode\u003e/bin/bash -c '\u0026lt;arbitrary_command\u0026gt;'\u003c/code\u003e which the server permits because \u003ccode\u003e/bin/bash\u003c/code\u003e is on the allowlist and the string contains no forbidden metacharacters.\u003c/li\u003e\n\u003cli\u003eThe server process spawns the interpreter, which in turn executes the embedded malicious payload.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves arbitrary code execution on the host with the privileges of the mcp-shell process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full arbitrary command execution on the host system running mcp-shell. Given that mcp-shell is designed to interact with LLMs, this can result in unauthorized data exfiltration, system configuration changes, and lateral movement from the host. Because the threat model involves LLMs acting as the agent, the vulnerability is reachable without network-level access, provided the LLM has been tricked or configured to invoke the \u003ccode\u003eshell_exec\u003c/code\u003e tool.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade mcp-shell to version 0.6.0 or higher immediately to address the insecure default configurations and updated example allowlists.\u003c/li\u003e\n\u003cli\u003eFor existing deployments, manually create a restrictive \u003ccode\u003esecurity.yaml\u003c/code\u003e that excludes all shell interpreters (e.g., \u003ccode\u003ebash\u003c/code\u003e, \u003ccode\u003esh\u003c/code\u003e, \u003ccode\u003epython\u003c/code\u003e, \u003ccode\u003eperl\u003c/code\u003e, \u003ccode\u003eruby\u003c/code\u003e) and enforce \u003ccode\u003eEnabled: true\u003c/code\u003e in the configuration.\u003c/li\u003e\n\u003cli\u003eSet the \u003ccode\u003eMCP_SHELL_SEC_CONFIG_FILE\u003c/code\u003e environment variable explicitly in all deployment environments (including Kubernetes/Docker orchestrators) to ensure validation is active.\u003c/li\u003e\n\u003cli\u003eImplement strict sandboxing (e.g., Docker containers with minimal capabilities or separate namespaces) for mcp-shell processes as a layer of defense-in-depth, acknowledging that sandboxing does not mitigate the primary vulnerability of unauthorized intra-session command execution.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-25T16:02:20Z","date_published":"2026-08-25T16:02:06Z","id":"https://feed.craftedsignal.io/briefs/2026-08-mcp-shell-insecure-defaults/","summary":"mcp-shell versions prior to 0.6.0 suffer from default-disabled security settings and insecure allowlists, enabling unauthenticated arbitrary command execution via connected LLM agents.","title":"mcp-shell Insecure Configuration and Allowlist Bypass","url":"https://feed.craftedsignal.io/briefs/2026-08-mcp-shell-insecure-defaults/"}],"language":"en","title":"CraftedSignal Threat Feed - Mcp-Shell","version":"https://jsonfeed.org/version/1.1"}