CVE-2026-55581: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in sonirico mcp-shell

The mcp-shell product from sonirico, used for running shell commands securely and auditably, has an OS command injection vulnerability (CWE-78) before version 0.6.0. The default Docker security.yaml includes /bin/bash in allowed executables, but the validation logic only inspects the first token of the command and fails to reject the shell command-mode flag '-c'. Consequently, an attacker can supply a command argument such as `/bin/bash -c <arbitrary-command>`, which bypasses validation and is executed by exec.CommandContext as the mcpuser, outside the intended allowlist. This vulnerability is addressed in version 0.6.0.

Successful exploitation allows an attacker to execute arbitrary OS commands as the mcpuser, potentially leading to full compromise of the system's confidentiality, integrity, and availability. The CVSS score is 8.4 (high severity), reflecting the local attack vector with low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

This vulnerability is fixed in sonirico mcp-shell version 0.6.0. Users should upgrade to version 0.6.0 or later to remediate this issue. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed in the vendor advisory, but the fix is stated to be in version 0.6.0.