Executive brief
LudusMCP is a tool for managing Ludus lab environments through natural language commands. A vulnerability in its CLI wrapper allows local attackers to inject arbitrary shell commands when the primary command execution path fails, potentially enabling unauthorized code execution on the system running the MCP server.
Technical details
The vulnerability is a command injection flaw in src/ludusMCP/cliWrapper.ts affecting the executeArbitraryCommand() and executeCommand() functions. The code safely uses spawn('ludus', ludusArgs, { shell: false }) as the primary execution path; however, when this path errors or times out, a fallback invokes execSync(ludusCommand), where ludusCommand is constructed by concatenating caller-controlled command and args parameters into a shell string without proper escaping. The ludus_cli_execute MCP tool accepts these parameters from the caller. An attacker with local access can craft an MCP JSON-RPC request with shell metacharacters in the command or args field to trigger the fallback path and achieve arbitrary command injection.
Affected products
- NocteDefensor LudusMCP up to 1.0.24
Timeline
- 2026-08-06: disclosed
- other: Issue report filed; vendor has not yet responded