Executive brief
Token Optimizer MCP is a Node.js-based tool that analyzes and optimizes AI agent token usage. The smart_user component contains an OS command injection vulnerability in its get-user-info operation, where user-supplied usernames are directly interpolated into shell commands without proper escaping. An attacker with access to the MCP server can execute arbitrary shell commands with the privileges of the server process, potentially leading to unauthorized file access, data theft, or system compromise.
Technical details
The vulnerability is a CWE-78 OS command injection in the smart_user tool's get-user-info operation. The vulnerable code interpolates a user-controlled username parameter directly into a shell command string: `getent passwd "${username}" || grep "^${username}:" /etc/passwd`, then executes it via execAsync(). Although the username is wrapped in double quotes, POSIX shells still evaluate command substitution syntax ($(...) and backticks) within double-quoted strings, allowing an attacker to inject arbitrary commands. An MCP client can supply a crafted username such as $(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID) to execute the id command and write output to a file, or any other arbitrary shell command. The fix (released in v5.1.0) replaces string-based command construction with argv-mode execution using execFileSafe and in-process fallbacks, eliminating shell interpretation of the username argument. This vulnerability requires network/local access to the MCP server but no authentication or user interaction.
Affected products
- ooples token-optimizer-mcp <5.1.0
Timeline
- 2026-06-10: disclosed
- 2026-08-14: advisory
- 2026-06-10: patched: Fix released in v5.1.0