CVE-2026-55582
Received Received - Intake

Command Injection in mcp-shell via Git Alias Bypass

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default security.yaml allows /usr/bin/git, while security.go omits ! from containsShellMetacharacters and containsDangerousShellConstructs and applies no per-executable argument policy. A caller of the shell_exec MCP tool can provide the command argument /usr/bin/git -c alias.pwn=!<arbitrary-command>, causing Git to create a shell alias and execute arbitrary OS commands as the mcp-shell process user. The default Docker image runs as mcpuser with Git installed and secure mode enabled, so the bypass is exploitable in the default deployment without additional authentication beyond MCP connectivity. This issue is fixed in version 0.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-55582
EUVD
EUVD-2026-65548

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55582 is an OS Command Injection flaw in mcp-shell versions before 0.6.0. The vulnerability allows attackers to bypass the secure mode feature, which restricts command execution to an allowlist. The issue occurs because the security validator omits the exclamation mark (!), which Git uses for shell aliases. Attackers can craft commands using Git's -c alias.NAME=!CMD syntax to execute arbitrary OS commands as the mcp-shell process user.

For example, passing /usr/bin/git -c alias.pwn=!touch /tmp/malicious would create a file at /tmp/malicious inside the container. This bypasses the intended security restrictions entirely.

Detection Guidance

Check if mcp-shell is running a version prior to 0.6.0 by inspecting the container or process logs. Look for Git command usage with the -c alias flag, such as /usr/bin/git -c alias.pwn=!<arbitrary-command>. Verify if the security.yaml file allows /usr/bin/git without proper argument restrictions.

  • Run: docker ps | grep mcp-shell to identify running containers.
  • Run: docker exec <container-id> mcp-shell --version to check the version.
  • Run: docker exec <container-id> cat /path/to/security.yaml to review allowed executables.
Impact Analysis

This vulnerability allows arbitrary OS command execution as the mcp-shell process user within the container. Attackers can create files, modify system configurations, or execute malicious commands without authentication beyond MCP connectivity. The default Docker deployment runs as a non-root user but still permits full command execution within the container environment.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. It enables attackers to access, modify, or exfiltrate sensitive data within the container, undermining compliance with data protection regulations that mandate strict access controls and auditability.

Mitigation Strategies

Upgrade mcp-shell to version 0.6.0 or later immediately. If upgrading is not possible, disable the shell_exec MCP tool or restrict access to trusted users only. Remove Git from the default allowed executables in security.yaml and add strict argument policies for permitted commands.

  • Run: docker pull sonirico/mcp-shell:0.6.0 to update the container image.
  • Run: docker stop <container-id> && docker rm <container-id> to redeploy with the updated image.
  • Edit security.yaml to remove /usr/bin/git from allowed executables and enforce per-executable argument policies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55582. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart