Read the docs
TI-2026-40119 Aliases CVE-2026-55580GHSA-f5pj-2738-996m

mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist

Priority HIGH 72CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, config.go initializes Security.Enabled to false, and when MCP_SHELL_SEC_CONFIG_FILE is unset, main.go starts the documented bare-binary deployment without a security policy. SecurityValidator.validateCommand in security.go then short-circuits and allows every command supplied to the shell_exec MCP tool, so an LLM connected over stdio can execute unrestricted OS commands as the mcp-shell process user. The README from-source installation and MCP client configuration omit MCP_SHELL_SEC_CONFIG_FILE, making the insecure state the documented default. This issue is fixed in version 0.6.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00197 9th percentileScored 2026-11-07
Fix Fixed mcp-shell (sonirico): 0.6.0github.com/sonirico/mcp-shell (Go): 0.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
soniricomcp-shellbefore 0.6.00.6.0Patch availableCNA
—github.com/sonirico/mcp-shell (Go)before 0.6.00.6.0Patch availableGHSA-f5pj-2738-996m
  • mcp-shell Vendorsonirico Affected before 0.6.0 Fixed in 0.6.0 Patch available CNA
  • github.com/sonirico/mcp-shell (Go) Vendor— Affected before 0.6.0 Fixed in 0.6.0 Patch available GHSA-f5pj-2738-996m

Remediation

  • Fix · CNA mcp-shell (sonirico) Fixed in 0.6.0
  • Fix · GHSA-f5pj-2738-996m github.com/sonirico/mcp-shell (Go) Fixed in 0.6.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55580
  2. 2026-10-03 Alias added: GHSA-f5pj-2738-996m

References

Other 5

  • TI-2026-40121 mcp-shell: Secure Mode Allowlist Bypass via Git Shell Alias CVSS 3.1HIGH 8.4
  • TI-2026-40120 mcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` Executable CVSS 3.1HIGH 8.4
  • TI-2025-38006 A command injection vulnerability in the shell_exec function of sonirico mcp-shell v0.3.1… CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences