These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in mcp-shell, a secure MCP server for running shell commands, allows for arbitrary OS command execution. The issue arises from the default security.yaml configuration and a bypass in security.go, enabling a caller of the shell_exec MCP tool to execute arbitrary commands as the mcp-shell process user. This is exploitable in the default Docker image deployment without additional authenticati [truncated]
A vulnerability in mcp-shell, a secure MCP server for running shell commands, allows attackers to execute arbitrary commands as mcpuser. The issue arises from the default configuration allowing /bin/bash and inadequate validation of command arguments. This problem is resolved in version 0.6.0. The vulnerability is caused by the default Docker security.yaml including /bin/bash in allowed_executables, while [truncated]
A vulnerability in mcp-shell, a secure MCP server for running shell commands, allows unrestricted OS command execution as the mcp-shell process user when the MCP_SHELL_SEC_CONFIG_FILE environment variable is unset, leading to a HIGH severity CVSS score of 8.6. The issue, fixed in version 0.6.0, arises from the insecure default configuration and lack of security policy enforcement.