Executive brief
MCP Watch is a security scanner for Model Context Protocol (MCP) servers. The tool contains a critical vulnerability in its repository cloning function that allows attackers to execute arbitrary commands on any system running the scanner. An attacker can craft a malicious repository URL and trick a user or automated service into scanning it, immediately compromising the machine with full code execution.
Technical details
The MCPScanner class in src/scanner/MCPScanner.ts passes a user-supplied GitHub URL directly to child_process.execSync() in the cloneRepo method without sanitization or validation. Because execSync spawns a shell (/bin/sh on Unix, cmd.exe on Windows), shell metacharacters in the URL (e.g., semicolons, ampersands, pipes) are interpreted by the shell rather than treated as literal URL characters. An attacker can inject arbitrary commands by appending shell separators and payloads to the URL argument (e.g., "https://github.com/user/repo & rm -rf /"). The vulnerability requires network access and no authentication, and can be exploited when a user runs the CLI tool or when the scanner is deployed as a web service. An attacker gains full remote code execution with the privileges of the scanner process. A patch is available in commit e7da78c.
Affected products
- kapilduraphe mcp-watch 0.1.2 and earlier
Timeline
- 2025-12-02: disclosed: Vulnerability published via GitHub Advisory GHSA-27m7-ffhq-jqrm
- 2025-12-02: patched: Fix available in commit e7da78c5b4b960f8b66c254059ad9ebc544a91a6