CVE-2026-108953 in mac-shell-mcp
Summary
by MITRE • 10/12/2026
mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into execute_command arguments. Attackers or malicious prompts can call a safe command such as pwd with arguments like ';' to run forbidden commands as the server user without approval.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The mac-shell-mcp software, prior to version 2.0.0, suffers from a critical OS Command Injection vulnerability that fundamentally compromises the integrity of its security controls. This flaw resides in how the application processes arguments passed to the execute_command function by Model Context Protocol clients. The system is designed with a whitelist mechanism intended to restrict users to executing only pre-approved commands, thereby limiting the potential attack surface and preventing arbitrary code execution on the host server. However, the implementation fails to properly sanitize or validate shell metacharacters within these arguments, allowing malicious actors to bypass this restriction entirely through input manipulation.
The technical root cause of this vulnerability is a failure in input validation logic when handling command-line arguments. Specifically, the application does not escape or filter special characters that have meaning to the underlying operating system shell. An attacker can exploit this by injecting metacharacters such as semicolons into what appears to be a benign argument for an allowed command like pwd. For instance, passing a value containing ';' allows the injection of additional commands after the intended execution. Because the application likely constructs and executes these commands using a shell interpreter rather than direct system calls with fixed arguments, the injected metacharacters are interpreted by the shell as command separators or logical operators. This enables the concatenation of arbitrary malicious payloads to legitimate whitelisted commands, effectively circumventing the whitelist protection mechanism without triggering any security alerts or requiring elevated privileges beyond those granted to the server process user.
The operational impact of this vulnerability is severe, granting attackers full remote code execution capabilities under the context of the mac-shell-mcp service account. By leveraging simple shell metacharacters, an adversary can execute arbitrary system commands, read sensitive configuration files, exfiltrate data, or pivot further into the network infrastructure. Since the command runs as the server user, if this account possesses administrative privileges or access to critical resources, the compromise extends beyond mere code execution to potential full system takeover. This is particularly dangerous in environments where MCP clients are exposed to untrusted inputs or when malicious prompts can be injected via integrated AI models that do not adequately filter their own outputs before sending them to backend services.
This vulnerability aligns with CWE-78, Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. From a tactical perspective, it maps directly to the ATT&CK technique T1059, specifically sub-technique 004 which covers Unix Shell Commands. The exploitation vector relies on the attacker providing malicious input that is interpreted by the operating system shell rather than being treated strictly as data. This distinction highlights the importance of separating code from data during command construction to prevent such injection attacks.
To mitigate this vulnerability, immediate upgrade to version 2.0.0 or later is required, where the developers have presumably implemented proper sanitization and validation routines. In interim scenarios where upgrading is not immediately feasible, organizations should implement strict input filtering at a network or application gateway level to block shell metacharacters in arguments destined for this service. Additionally, adopting defense-in-depth strategies such as running the mac-shell-mcp process with minimal privileges using principle of least privilege can limit the blast radius if an exploitation occurs. It is also advisable to review all MCP client integrations to ensure that prompts and inputs are validated before being passed to backend command execution modules, ensuring that no untrusted data influences shell interpretation logic.