Executive brief
cli-mcp-server is an MCP (Model Context Protocol) server that allows command-line interface execution with configurable security policies. Version 0.2.5 contains a flaw that permits attackers to bypass command allowlists when shell operators are enabled, allowing execution of unauthorized commands and potentially leading to arbitrary code execution or system compromise.
Technical details
The vulnerability is an allowlist bypass in the _validate_command_with_operators function when ALLOW_SHELL_OPERATORS is enabled. Attackers can use shell command substitution syntax such as $(...) or backticks to execute commands that are not in the ALLOWED_COMMANDS list, circumventing the intended validation check. The issue affects cli-mcp-server version 0.2.5 and allows remote code execution if an attacker can send commands to an affected server instance. A patch is expected as this appears to be a recent disclosure.
Affected products
- Mladen Šukara cli-mcp-server 0.2.5
Timeline
- 2026-09-04: disclosed