Vendor
The token-optimizer-mcp package is vulnerable to OS command injection via the smart_user tool due to insecure interpolation of user-supplied input into shell commands, allowing arbitrary command execution with application privileges.