---
id: CVE-2026-55582
title: >-
  mcp-shell is an MCP server for running shell commands securely, auditably, and
  on demand
summary: >-
  mcp-shell is an MCP server for running shell commands securely, auditably, and
  on demand. Prior to 0.6.0, the default security.yaml allows /usr/bin/git,
  while security.go omits ! from containsShellMetacharacters and
  containsDangerousShel…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: sonirico
product: github.com/sonirico/mcp-shell
affected:
  - github.com/sonirico/mcp-shell < 0.6.0
patched:
  - github.com/sonirico/mcp-shell 0.6.0
published: '2026-08-25'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:07:31.353'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55582'
references:
  - url: >-
      https://github.com/sonirico/mcp-shell/commit/f31377fce6ec31114e5a4398c0e5270552bce09f
    label: security-advisories@github.com
  - url: 'https://github.com/sonirico/mcp-shell/pull/16'
    label: security-advisories@github.com
  - url: 'https://github.com/sonirico/mcp-shell/releases/tag/v0.6.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/sonirico/mcp-shell/security/advisories/GHSA-74hp-mggr-hv58
    label: security-advisories@github.com
  - url: >-
      https://github.com/sonirico/mcp-shell/security/advisories/GHSA-74hp-mggr-hv58
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-74hp-mggr-hv58'
tags:
  - nvd
  - ghsa
  - go
epss: 0.00267
epssPercentile: 0.16826
aliases:
  - GHSA-74hp-mggr-hv58
ecosystem: go
ingestedAt: '2026-08-25T16:28:51.247Z'
---

## Overview

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default security.yaml allows /usr/bin/git, while security.go omits ! from containsShellMetacharacters and containsDangerousShellConstructs and applies no per-executable argument policy. A caller of the shell_exec MCP tool can provide the command argument /usr/bin/git -c alias.pwn=!<arbitrary-command>, causing Git to create a shell alias and execute arbitrary OS commands as the mcp-shell process user. The default Docker image runs as mcpuser with Git installed and secure mode enabled, so the bypass is exploitable in the default deployment without additional authentication beyond MCP connectivity. This issue is fixed in version 0.6.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55582)

Affected packages:

- `github.com/sonirico/mcp-shell < 0.6.0`

Patched in:

- `github.com/sonirico/mcp-shell 0.6.0`

Source: https://github.com/advisories/GHSA-74hp-mggr-hv58