Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-26 · high
Follow the project's own Docker setup and a shell metacharacter check still lets commands past the allowlist.
Why now: Three advisories against the project posted together, fixed in version 0.6.0.
sonirico/mcp-shell says it runs shell commands "securely, auditably, and on demand." Three advisories say otherwise.
The bare-binary deploy, the one in the project's own docs, ships with no policy enforcement at all. GHSA-f5pj-2738-996m traces it to config.go, which initializes Security.Enabled to false. Skip the extra config step most users would skip, and every command runs unchecked. That one scores 8.6.
The Docker path, the one meant to fix that, has its own hole. The image ships a security.yaml that allowlists /bin/bash but only validates the first token of the command. /bin/bash -c followed by anything gets through. A second bypass works the same way through git aliases: git -c alias.pwn=!<command> runs arbitrary code because the metacharacter check never accounts for !. That one is 8.4.
So the two paths the docs actually describe both fail open. Skip the config and get no security. Follow the official Docker example and get a security file that doesn't do its job.
All three are fixed in 0.6.0. The advisory doesn't say how long the flaws sat in prior releases or whether any deployments were hit before the fix. If you're running an older tag, the move is checking whether Security.Enabled actually flips true in your config, not trusting that pulling the Docker image did it for you.
Each link below shares sources, entities, or timing with this story.
Shared entities / Same source domain / Shared topic / Earlier coverage
Both cover Fixed, GHSA; reported by the same outlet (github.com); overlapping topics (advisory, bypass).
Shared entity: GHSA / Same source domain / Shared topic / Tension
Both cover GHSA; reported by the same outlet (github.com); overlapping topics (advisory, against, allowlist).
Shared entities / Same source domain / Earlier coverage
Both cover GHSA, SECURITY; reported by the same outlet (github.com); earlier GHSA coverage from 2026-02-27.
Shared entity: GHSA / Same source domain / Shared topic / Earlier coverage
Both cover GHSA; reported by the same outlet (github.com); overlapping topics (check, config).
Both cover GHSA; reported by the same outlet (github.com); overlapping topics (advisory, arbitrary).
Shared entity: Security / Same source domain / Shared topic / Earlier coverage
Both cover Security; reported by the same outlet (github.com); overlapping topics (command, config).
Shared entities / Same source domain
Both cover Fixed, GHSA; reported by the same outlet (github.com).
Both cover Fixed, GHSA; reported by the same outlet (github.com).