{"items":[{"id":"NVI-00016352","kind":"vulnerability","title":"mcp-shell has a Secure Mode Allowlist Bypass via Git Shell Alias","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-74hp-mggr-hv58","CVE-2026-55582"],"plain_summary":"GitHub lists this reviewed advisory for github.com/sonirico/mcp-shell. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6a49485dbde2aca9d467544c110ac832"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-25T15:39:07.000Z","value":"8.4 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-6a49485dbde2aca9d467544c110ac832"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6a49485dbde2aca9d467544c110ac832","url":"https://github.com/advisories/GHSA-74hp-mggr-hv58","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-74hp-mggr-hv58","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T09:56:37.775Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6a49485dbde2aca9d467544c110ac832"],"technology":"github.com/sonirico/mcp-shell","known_exclusions":[],"conditions_summary":"### Summary\n\n`mcp-shell`'s \"secure mode\" is designed to restrict command execution to an allowlist of executables defined in `security.yaml`. The default configuration includes `/usr/bin/git`. The security validator in `security.go` blocks common shell metacharacters (`|&;(){}[]$\\``) but omits `!`, which is the prefix Git uses to execute shell aliases (`alias.NAME=!CMD`). An attacker who can invoke the `shell_exec` MCP tool can pass `/usr/bin/git -c alias.pwn=!` as the command argument, bypassing all validation and achieving arbitrary OS command execution as the `mcp-shell` process user. The default Docker image runs as `mcpuser` (UID 1000) with Git installed and secure mode enabled, making this exploitable in the default deployment with no authentication required.\n\n### Details\n\nThe vulnerability is a classic OS Command Injection (CWE-78) in the `shell_exec` MCP tool handler. The data flow from attacker input to shell execution is:\n\n1. **`main.go:89-91`** — The MCP tool schema exposes a required string parameter `command` with no server-side type constraints.\n2. **`main.go:102`** — `shell_exec` is bound to `shellHandler.handle`.\n3. **`handler.go:34`** — The han","public_affected_ranges":["< 0.6.0"]}],"null_published_at":"2026-11-04T10:04:27.935Z","source_updated_at":"2026-08-25T15:39:07.000Z","source_disclosed_at":"2026-08-25T15:39:05.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T09:56:37.775Z"}],"next_cursor":null,"snapshot_revision":"42594"}