The token-optimizer-mcp package (tested in v5.0.1) has an OS command injection vulnerability (CWE-78) in the smart_user tool. The get-user-info operation accepts a username parameter that is directly interpolated into a shell command string executed by execAsync(). Although the username is wrapped in double quotes, POSIX shells still evaluate command substitution such as $(...) and backticks inside double quotes. An attacker can supply a crafted username containing command substitution to execute arbitrary commands on the host with the MCP server's user privileges. A proof-of-concept demonstrates writing the output of the id command to a file under /tmp, confirming command execution. The vulnerability affects versions prior to 5.1.0.

An attacker able to invoke the smart_user tool's get-user-info operation with a controlled username can execute arbitrary OS commands on the MCP server with the privileges of the user running the MCP server process. This can lead to full compromise of the server environment depending on the MCP server user's privileges. The CVSS 3.1 score is 8.4 (high), reflecting high confidentiality, integrity, and availability impact.

A patch is available for this vulnerability. Users should upgrade token-optimizer-mcp to version 5.1.0 or later where this issue is fixed. Until patched, avoid exposing the smart_user tool's get-user-info operation to untrusted clients or inputs. The vendor advisory confirms a fix is available; apply the official update to remediate.