Executive brief
mcp-shell is a command-execution server that uses a security allowlist to restrict which programs can be run. The default configuration allows Git (`/usr/bin/git`) but fails to block the exclamation mark (`!`) character. Git interprets `!` as a prefix for shell aliases, allowing an attacker to pass commands like `/usr/bin/git -c alias.pwn=!touch pwn /tmp/file` that bypass the security restrictions entirely. Any client that can connect to the service can achieve arbitrary command execution as the unprivileged `mcpuser` account running inside the default Docker container.
Technical details
This is an OS Command Injection vulnerability (CWE-78) in the `shell_exec` MCP tool handler. The security validator in `security.go:136` blocks common shell metacharacters (`|&;<>(){}[]$\`` and backticks) but omits `!`, which Git recognizes as the prefix for shell alias expansion. When an attacker supplies `/usr/bin/git -c alias.pwn=!<cmd>` as the command argument, the validation passes (Git is allowlisted, and `!` is not in the blocked set). The command is then executed via `exec.CommandContext()` with the unsanitized arguments. Git interprets `-c alias.pwn=!touch` as a configuration directive that defines a shell alias, and when the subcommand `pwn` is invoked, it expands to a shell execution of `touch`. The root cause is both the missing `!` in the metacharacter blocklist and the absence of per-executable argument policies that would restrict Git's `-c alias.*=!` pattern. The vulnerability is exploitable in the default Docker deployment with no additional authentication required.
Affected products
- sonirico mcp-shell < 0.6.0
Timeline
- 2026-08-25: disclosed: Published in GitHub Advisory Database
- 2026-06-14: other: Initially reviewed by GitHub