{"id":"CVE-2026-55581","title":"mcp-shell is an MCP server for running shell commands securely, auditably, and on demand","summary":"mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash in allowed_executables, while security.go validates only the first token and ch…","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-78","CWE-183","CWE-1188"],"vendor":"sonirico","product":"github.com/sonirico/mcp-shell","affected":["github.com/sonirico/mcp-shell < 0.6.0"],"patched":["github.com/sonirico/mcp-shell 0.6.0"],"published":"2026-08-25","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:07:31.353","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55581","references":[{"url":"https://github.com/sonirico/mcp-shell/commit/f31377fce6ec31114e5a4398c0e5270552bce09f","label":"security-advisories@github.com"},{"url":"https://github.com/sonirico/mcp-shell/pull/16","label":"security-advisories@github.com"},{"url":"https://github.com/sonirico/mcp-shell/releases/tag/v0.6.0","label":"security-advisories@github.com"},{"url":"https://github.com/sonirico/mcp-shell/security/advisories/GHSA-3x77-wg38-92r3","label":"security-advisories@github.com"},{"url":"https://github.com/sonirico/mcp-shell/security/advisories/GHSA-3x77-wg38-92r3","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-3x77-wg38-92r3"},{"url":"https://github.com/sonirico/mcp-shell"}],"tags":["nvd","ghsa","go","osv"],"epss":0.0034,"epssPercentile":0.27616,"aliases":["GHSA-3x77-wg38-92r3","GO-2026-6290"],"ecosystem":"go","ingestedAt":"2026-08-25T16:28:51.207Z","slug":"CVE-2026-55581","body":"## Overview\n\nmcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash in allowed_executables, while security.go validates only the first token and checkBlockedPatternsAndCommands does not reject the shell command-mode flag -c. A caller of the shell_exec MCP tool can provide the command argument `/bin/bash -c <arbitrary-command>`, which passes validation and reaches executor.go, where parseCommand and exec.CommandContext execute the arbitrary command as mcpuser outside the intended allowlist. This issue is fixed in version 0.6.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55581)\n\nAffected packages:\n\n- `github.com/sonirico/mcp-shell < 0.6.0`\n\nPatched in:\n\n- `github.com/sonirico/mcp-shell 0.6.0`\n\nSource: https://github.com/advisories/GHSA-3x77-wg38-92r3","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}