Executive brief
fast-filesystem-mcp is a server component that provides filesystem access for AI assistants. It contains a command injection vulnerability in its disk usage function that allows attackers to execute arbitrary shell commands on the server. An attacker can craft malicious input that bypasses safety checks and runs unauthorized code with the server's privileges, potentially leading to data theft or system compromise.
Technical details
The vulnerability is a command injection (CWE-74) affecting fast-filesystem-mcp versions up to 3.5.1. The vulnerable code in src/index.ts constructs shell commands using user-supplied parameters (such as path, output_path, archive_path, extract_to) and executes them via child_process.execAsync. Since execAsync invokes commands through a system shell, an attacker can inject shell metacharacters (;, &, |, etc.) to break out of the intended command and execute arbitrary shell commands. The attack requires network access and authentication/authorization to invoke the affected MCP tools, but once reachable, no special preconditions are needed. Successful exploitation allows remote code execution with the privileges of the MCP server process. The recommended fix is to replace execAsync/execSync with execFileSync, which does not invoke a shell, and to apply strict input validation on all path parameters.
Affected products
- efforthye fast-filesystem-mcp up to 3.5.1
Timeline
- 2026-04-02: disclosed: Published in NVD and GitHub advisory database
- 2026-03-08: other: Security issue reported on GitHub