| タイトル | mcollina mcp-ripgrep Latest OS Command Injection |
|---|
| 説明 | SUMMARY
OS command injection in the mcp-ripgrep MCP server via the unsanitized fileType parameter of the advanced-search tool, allowing arbitrary command execution under the server process user.
VULNERABILITY CLASS
OS Command Injection -> Remote Code Execution (CWE-78)
AFFECTED
File: src/index.ts (advanced-search tool handler / command builder)
Parameter: "fileType" argument of the advanced-search tool
Auth: not applicable (stdio transport carries no auth model)
ROOT CAUSE
args.fileType is concatenated directly into the ripgrep command string (command += " -t " + fileType) and the command is executed via spawn(program, args, { shell: true }). Setting shell:true reintroduces shell parsing, so metacharacters in fileType (backtick, $(), |, >, &&) execute as arbitrary commands. Because MCP tools are invoked by AI assistants that process untrusted content (documents, web pages, emails), this is also reachable via indirect prompt injection: untrusted content instructing the assistant to call advanced-search with a malicious fileType causes the embedded command to run on the host.
IMPACT
Command injection / remote code execution under the server process privileges. Reachable directly by any client driving the stdio server, and indirectly via prompt injection through an AI assistant.
PROOF OF CONCEPT (MCP Inspector CLI)
npx @modelcontextprotocol/inspector --cli npx -y mcp-ripgrep@latest \
--method tools/call --tool-name advanced-search \
--tool-arg pattern=foo --tool-arg path=/tmp \
--tool-arg "fileType=js`id>/tmp/PWNED`"
Result: /tmp/PWNED is created containing the output of id. Also reproduced
via an AI assistant using indirect prompt injection.
REMEDIATION
Use spawn with shell:false and an argument array; additionally reject any
fileType not matching ^[A-Za-z0-9_+-]+$.
CVSS (stdio / local transport)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (7.8 High)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (8.5 High)
LINKS
Product: https://www.npmjs.com/package/mcp-ripgrep
Vendor: https://github.com/mcollina/mcp-ripgrep
DISCLOSURE
Vendor contacted via GitHub Advisory on Feb 19 no response received. |
|---|
| ソース | ⚠️ https://gist.github.com/sandh0t/45fdee24a7907e0cd836aed26f2d5a7a/ |
|---|
| ユーザー | sandh0t (UID 101360) |
|---|
| 送信 | 2026年09月18日 12:31 (1 月 ago) |
|---|
| モデレーション | 2026年10月20日 06:21 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 422653 [mcollina mcp-ripgrep 迄 0.4.0 Advanced Search Tool src/index.ts fileType 特権昇格] |
|---|
| ポイント | 20 |
|---|