CVE-2026-55581
Received Received - Intake

Command Injection in mcp-shell

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash in allowed_executables, while security.go validates only the first token and checkBlockedPatternsAndCommands does not reject the shell command-mode flag -c. A caller of the shell_exec MCP tool can provide the command argument `/bin/bash -c <arbitrary-command>`, which passes validation and reaches executor.go, where parseCommand and exec.CommandContext execute the arbitrary command as mcpuser outside the intended allowlist. This issue is fixed in version 0.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-55581
EUVD
EUVD-2026-65549

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sonirico mcp-shell 0.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
CWE-183 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55581 is an OS Command Injection vulnerability in mcp-shell, a tool that restricts command execution via an allowlist in secure mode. The default configuration includes /bin/bash in the allowlist, but the validation logic only checks the first token of a command. Attackers can bypass restrictions by using shell flags like -c, enabling execution of arbitrary commands inside the container as the mcpuser user.

Detection Guidance

Check if mcp-shell is running in your environment, particularly version 0.6.0 or earlier. Inspect Docker containers for the presence of mcp-shell and review their security.yaml configuration for allowed_executables including /bin/bash. Look for unusual command execution patterns or unauthorized processes running as mcpuser.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the system running mcp-shell, potentially leading to confidentiality breaches (e.g., accessing sensitive data), integrity violations (e.g., modifying files), or availability issues (e.g., causing system slowdowns). It works with default configurations and requires no authentication.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection), HIPAA (health information security), and other regulations by enabling unauthorized access to sensitive data, system tampering, or service disruption. It undermines security controls required by these standards.

Mitigation Strategies

Upgrade mcp-shell to version 0.6.0 or later. Remove /bin/bash and other shell executables from the allowed_executables list in security.yaml. Add validation to block shell command-mode flags like -c. Ensure no unauthorized commands are being executed by monitoring mcpuser activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55581. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart