{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/sonirico/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["mcp-shell"],"_cs_severities":["high"],"_cs_tags":["vulnerability","rce","mcp","llm-security"],"_cs_type":"advisory","_cs_vendors":["sonirico"],"content_html":"\u003cp\u003emcp-shell, a tool designed to provide shell execution capabilities to Large Language Models (LLMs) via the Model Context Protocol (MCP), contains two critical configuration flaws that negate its security controls. First, the application ships with security features disabled by default in \u003ccode\u003econfig.go\u003c/code\u003e. Unless an operator explicitly defines the \u003ccode\u003eMCP_SHELL_SEC_CONFIG_FILE\u003c/code\u003e environment variable, the \u003ccode\u003evalidateCommand\u003c/code\u003e function short-circuits and allows all incoming commands without restriction. Second, the default \u003ccode\u003esecurity.yaml\u003c/code\u003e configuration included in the Docker image provides an insecure allowlist containing shell interpreters such as \u003ccode\u003e/bin/bash\u003c/code\u003e and \u003ccode\u003e/usr/bin/python3\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThese flaws enable an LLM connected to the mcp-shell server to execute arbitrary commands on the underlying system. The attack surface is significant because mcp-shell operates via stdio transport; an attacker (or a compromised/misaligned LLM agent) can issue \u003ccode\u003eshell_exec\u003c/code\u003e calls that bypass validation either due to the \u0026quot;disabled by default\u0026quot; state or by abusing allowed interpreters to execute nested command strings, effectively bypassing metacharacter filters. These vulnerabilities affect all deployments prior to version 0.6.0, including source-based and official container-based installations.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe operator deploys mcp-shell using default installation steps (git clone or official Docker image).\u003c/li\u003e\n\u003cli\u003eThe operator fails to explicitly set the \u003ccode\u003eMCP_SHELL_SEC_CONFIG_FILE\u003c/code\u003e environment variable, leaving the security module in a disabled state (Finding 1) OR the operator uses the default \u003ccode\u003esecurity.yaml\u003c/code\u003e which permits shell interpreters (Finding 2).\u003c/li\u003e\n\u003cli\u003eThe attacker (e.g., a malicious or poisoned LLM) establishes a session with the mcp-shell server over the stdio transport.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a \u003ccode\u003etools/call\u003c/code\u003e request to the mcp-shell server specifying the \u003ccode\u003eshell_exec\u003c/code\u003e method.\u003c/li\u003e\n\u003cli\u003eThe server process receives the command request; if security is disabled, it proceeds directly to system execution.\u003c/li\u003e\n\u003cli\u003eIf in \u0026quot;secure mode\u0026quot; with an insecure allowlist, the attacker executes \u003ccode\u003e/bin/bash -c '\u0026lt;arbitrary_command\u0026gt;'\u003c/code\u003e which the server permits because \u003ccode\u003e/bin/bash\u003c/code\u003e is on the allowlist and the string contains no forbidden metacharacters.\u003c/li\u003e\n\u003cli\u003eThe server process spawns the interpreter, which in turn executes the embedded malicious payload.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves arbitrary code execution on the host with the privileges of the mcp-shell process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full arbitrary command execution on the host system running mcp-shell. Given that mcp-shell is designed to interact with LLMs, this can result in unauthorized data exfiltration, system configuration changes, and lateral movement from the host. Because the threat model involves LLMs acting as the agent, the vulnerability is reachable without network-level access, provided the LLM has been tricked or configured to invoke the \u003ccode\u003eshell_exec\u003c/code\u003e tool.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade mcp-shell to version 0.6.0 or higher immediately to address the insecure default configurations and updated example allowlists.\u003c/li\u003e\n\u003cli\u003eFor existing deployments, manually create a restrictive \u003ccode\u003esecurity.yaml\u003c/code\u003e that excludes all shell interpreters (e.g., \u003ccode\u003ebash\u003c/code\u003e, \u003ccode\u003esh\u003c/code\u003e, \u003ccode\u003epython\u003c/code\u003e, \u003ccode\u003eperl\u003c/code\u003e, \u003ccode\u003eruby\u003c/code\u003e) and enforce \u003ccode\u003eEnabled: true\u003c/code\u003e in the configuration.\u003c/li\u003e\n\u003cli\u003eSet the \u003ccode\u003eMCP_SHELL_SEC_CONFIG_FILE\u003c/code\u003e environment variable explicitly in all deployment environments (including Kubernetes/Docker orchestrators) to ensure validation is active.\u003c/li\u003e\n\u003cli\u003eImplement strict sandboxing (e.g., Docker containers with minimal capabilities or separate namespaces) for mcp-shell processes as a layer of defense-in-depth, acknowledging that sandboxing does not mitigate the primary vulnerability of unauthorized intra-session command execution.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-25T16:02:20Z","date_published":"2026-08-25T16:02:06Z","id":"https://feed.craftedsignal.io/briefs/2026-08-mcp-shell-insecure-defaults/","summary":"mcp-shell versions prior to 0.6.0 suffer from default-disabled security settings and insecure allowlists, enabling unauthenticated arbitrary command execution via connected LLM agents.","title":"mcp-shell Insecure Configuration and Allowlist Bypass","url":"https://feed.craftedsignal.io/briefs/2026-08-mcp-shell-insecure-defaults/"}],"language":"en","title":"CraftedSignal Threat Feed - Sonirico","version":"https://jsonfeed.org/version/1.1"}