{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/token-optimizer-mcp/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["token-optimizer-mcp"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["ooples"],"content_html":"\u003cp\u003eThe \u003ccode\u003e@ooples/token-optimizer-mcp\u003c/code\u003e package (versions prior to 5.1.0) contains an OS command injection vulnerability within the \u003ccode\u003esmart_user\u003c/code\u003e tool's \u003ccode\u003eget-user-info\u003c/code\u003e operation. The application insecurely interpolates the user-provided \u003ccode\u003eusername\u003c/code\u003e argument directly into a shell command string that is subsequently executed using \u003ccode\u003eexecAsync()\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThe implementation uses the pattern \u003ccode\u003egetent passwd \u0026quot;${username}\u0026quot; || grep \u0026quot;^${username}:\u0026quot; /etc/passwd\u003c/code\u003e. Because POSIX shells evaluate command substitution syntax such as \u003ccode\u003e$(...)\u003c/code\u003e and backticks even when enclosed in double quotes, the application fails to sanitize malicious inputs. An attacker capable of invoking the \u003ccode\u003esmart_user\u003c/code\u003e tool through an MCP client can inject shell metacharacters to execute arbitrary commands with the identity and permissions of the process running the MCP server. This vulnerability, identified as CVE-2026-55157, poses a significant risk to the integrity and confidentiality of the host environment.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains access to an MCP client that can interact with the token-optimizer-mcp server.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the \u003ccode\u003esmart_user\u003c/code\u003e tool as a potential vector for interaction with the operating system.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious JSON-RPC request for the \u003ccode\u003etools/call\u003c/code\u003e method targeting the \u003ccode\u003esmart_user\u003c/code\u003e tool.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eusername\u003c/code\u003e argument is populated with an injection payload, such as \u003ccode\u003e$(id \u0026gt; /tmp/pwned)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe MCP server receives the request and passes the malicious string into the \u003ccode\u003eget-user-info\u003c/code\u003e tool implementation.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eexecAsync()\u003c/code\u003e function executes the shell command containing the attacker-controlled payload.\u003c/li\u003e\n\u003cli\u003eThe POSIX shell parses the command substitution inside the double quotes, triggering the execution of the injected command.\u003c/li\u003e\n\u003cli\u003eThe injected command runs with the privileges of the MCP server, potentially leading to system compromise or data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution with the privileges of the user running the MCP server process. This can lead to unauthorized access to system resources, potential lateral movement, and the execution of malicious tasks such as file creation or data exfiltration. The vulnerability impacts all environments where \u003ccode\u003e@ooples/token-optimizer-mcp\u003c/code\u003e version 5.0.1 or earlier is deployed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@ooples/token-optimizer-mcp\u003c/code\u003e to version 5.1.0 or later immediately to patch CVE-2026-55157.\u003c/li\u003e\n\u003cli\u003eImplement input validation and sanitization for all user-supplied arguments passed to shell execution functions.\u003c/li\u003e\n\u003cli\u003eReplace calls to shell-interpreting functions like \u003ccode\u003eexecAsync()\u003c/code\u003e with safer alternatives that do not invoke a shell (e.g., using \u003ccode\u003eexecFile()\u003c/code\u003e with distinct argument arrays).\u003c/li\u003e\n\u003cli\u003eDeploy the suggested Sigma rule to monitor for child processes spawned by the MCP server process.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-15T02:07:02Z","date_published":"2026-08-15T02:07:02Z","id":"https://feed.craftedsignal.io/briefs/2026-08-token-optimizer-mcp-rce/","summary":"The token-optimizer-mcp package is vulnerable to OS command injection via the smart_user tool due to insecure interpolation of user-supplied input into shell commands, allowing arbitrary command execution with application privileges.","title":"OS Command Injection in token-optimizer-mcp via smart_user","url":"https://feed.craftedsignal.io/briefs/2026-08-token-optimizer-mcp-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Token-Optimizer-Mcp","version":"https://jsonfeed.org/version/1.1"}