Vulnerabilities

TI-2026-40119 CVE-2026-55580 · GHSA-f5pj-2738-996m

mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist

HIGH 72

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand.

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.00197 Published 2026-08-25 Fixed in 0.6.0 CWE-78

TI-2026-40120 CVE-2026-55581 · GHSA-3x77-wg38-92r3

mcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` Executable

HIGH 72

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand.

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.00454 Published 2026-08-25 Fixed in 0.6.0 CWE-1188

TI-2026-40121 CVE-2026-55582 · GHSA-74hp-mggr-hv58

mcp-shell: Secure Mode Allowlist Bypass via Git Shell Alias

HIGH 72

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand.

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.00267 Published 2026-08-25 Fixed in 0.6.0 CWE-78

TI-2025-38006 CVE-2025-61489 · GHSA-573w-fmhg-vxq2

A command injection vulnerability in the shell_exec function of sonirico mcp-shell v0.3.1…

HIGH 68

A command injection vulnerability in the shell_exec function of sonirico mcp-shell v0.3.1 allows attackers to execute arbitrary commands via supplying a crafted command string.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00971 Published 2026-01-07 No fix listed CWE-77

Vulnerabilities

Filters

mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist

mcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` Executable

mcp-shell: Secure Mode Allowlist Bypass via Git Shell Alias

A command injection vulnerability in the shell_exec function of sonirico mcp-shell v0.3.1…