Executive brief
mcp-package-docs is a Model Context Protocol server that provides documentation for software packages (Go, npm, etc.). A command injection vulnerability allows attackers to execute arbitrary system commands by injecting shell metacharacters into package name parameters. Exploitation can occur through prompt injection attacks or direct API calls, leading to remote code execution with the privileges of the MCP server process.
Technical details
The vulnerability is a command injection flaw in the child_process.exec usage across multiple package documentation tools (go doc, npm, etc.). User-supplied input (package names, symbols) is concatenated directly into shell command strings without sanitization, allowing injection of shell metacharacters (|, >, &&, $(), etc.). The attack vector is network-based when the MCP client is remote, and requires user interaction or automated tool invocation. An attacker can inject commands via prompt injection (indirect) or direct API calls to the describe_go_package and similar tools. Successful exploitation results in arbitrary command execution. A fix was released in version 0.1.28; versions ≤0.1.27 are affected.
Affected products
- Sam McJunkin mcp-package-docs ≤0.1.27
Timeline
- 2025-07-18: disclosed
- 2025-07-18: patched: Fixed in version 0.1.28