Executive brief
mcp-cli is a command-line interface tool for managing model context protocol servers. The OAuth authentication handler contains a command injection vulnerability that allows remote attackers to execute arbitrary operating system commands on a user's machine. An attacker can exploit this by crafting a malicious authorization URL that bypasses input sanitization.
Technical details
The vulnerability exists in the redirectToAuthorization function of /src/oauth/provider.js, where user-controlled authorization URL parameters are passed to OS command execution without proper sanitization. The flaw allows OS command injection (CWE-77, CWE-78) through specially crafted OAuth authorization URLs. Attack complexity is high and requires user interaction or specific conditions, making exploitation difficult in practice. An attacker with the ability to control the authorization URL can inject shell metacharacters to execute arbitrary commands with the privileges of the user running mcp-cli. The issue was patched via commit 3562966, which implements proper sanitization of the authorization URL before use in system commands.
Affected products
- wong2 mcp-cli through 1.13.0
Timeline
- 2025-08-21: disclosed
- 2025-08-07: patched: Fix merged in PR #16 with commit 3562966