mcp-shell Ships Security Off in One Deploy Path and Bypassable in the Other (CVE-2026-55580/55581/55582)

GitHub Security Advisories·high signalXBlueskyLinkedInCopy link

Three advisories published 2026-08-25 against sonirico/mcp-shell, a server whose pitch is running shell commands "securely, auditably, and on demand." `config.go` initializes `Security.Enabled` to false so the documented bare-binary deploy runs with no policy at all (8.6), while the Docker image's shipped security.yaml allowlists `/bin/bash` and validates only the first token, so `/bin/bash -c <anything>` passes (8.4), as does `git -c alias.pwn=!<arbitrary>` because `!` is missing from the metacharacter check (8.4). The two failure modes bracket the entire audience: skip the config and you get nothing, follow the official example and you get a bypass. Fixed in 0.6.0.