CVE-2026-85660 in cli-mcp-server
Summary
by MITRE • 09/04/2026
cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with_operators function when ALLOW_SHELL_OPERATORS is enabled. Attackers can use shell command substitution syntax like $(...) or backticks to execute non-allowlisted commands that bypass the ALLOWED_COMMANDS validation check.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The cli-mcp-server version 0.2.5 suffers from a critical command injection vulnerability stemming from an insufficiently robust input validation mechanism within its core execution logic. Specifically, the _validate_command_with_operators function is designed to enforce security policies by checking user-supplied commands against a predefined allowlist of permitted operations when the ALLOW_SHELL_OPERATORS configuration flag is enabled. This feature aims to restrict shell interactions to safe, pre-approved utilities while allowing certain operators for flexibility. However, the implementation fails to adequately sanitize or parse command strings before they are processed by the underlying system shell, creating a significant security gap that allows attackers to circumvent these restrictions through syntactic manipulation of input data.
The technical flaw lies in how the validation function handles shell metacharacters and subshell execution syntax. When an attacker provides input containing command substitution patterns such as dollar-parentheses $(...) or backticks ``, the system interprets these not merely as literal characters but as instructions to execute nested commands within a new shell context. Because the allowlist check is performed on the outer, visible portion of the command string rather than recursively evaluating all potential execution paths generated by subshells, the validation logic incorrectly concludes that the input matches an allowed entry. Consequently, the malicious payload proceeds to execution without triggering any security alerts or blocking mechanisms, effectively bypassing the intended access control measures.
This vulnerability has severe operational implications for systems relying on cli-mcp-server for automated task management or remote administration via command-line interfaces. An authenticated attacker with write access to configuration parameters or input streams can exploit this flaw to execute arbitrary system commands with the privileges of the service account running the server. This could lead to complete compromise of the host operating system, including unauthorized data exfiltration, installation of persistent backdoors, lateral movement across networked systems, and disruption of critical services. The ability to bypass allowlists undermines the principle of least privilege, rendering security controls ineffective against determined adversaries who understand shell scripting nuances.
From a classification perspective, this issue aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. It also relates closely to CWE-20 Improper Input Validation, as the application fails to properly validate and sanitize user-supplied input before processing it. In terms of offensive security frameworks, this vulnerability facilitates techniques associated with MITRE ATT&CK T1059 Command and Scripting Interpreter, specifically sub-component T1059.004 Unix Shell, where attackers leverage shell features like command substitution to execute arbitrary code. The exploitation vector typically involves crafting specific payloads that exploit the parsing order of the shell interpreter relative to the application's validation logic.
To mitigate this vulnerability, immediate patching to a version beyond 0.2.5 is required if an official fix has been released by the maintainers. In environments where upgrading is not immediately feasible, administrators should disable the ALLOW_SHELL_OPERATORS setting entirely unless absolutely necessary for business operations. If shell operators must remain enabled, input validation logic must be rewritten to recursively parse and validate all nested command substitutions before execution. Implementing strict allowlists that only permit specific binaries without any argument manipulation or subshell capabilities is recommended. Additionally, deploying runtime application self-protection tools or intrusion detection systems capable of detecting anomalous shell activity can provide an additional layer of defense against exploitation attempts while longer-term remediation strategies are developed and deployed.