mac-shell-mcp releases before 2.0.0 suffer from a command injection flaw that allows clients to inject shell metacharacters into the execute_command arguments, bypassing an internal whitelist. The vulnerability is a classic OS command injection (CWE-78) that can cause remote code execution as the server process, granting attackers full control over the underlying system. Because the injected characters can trigger additional commands after a safe command like pwd, an attacker need not rely on any privileged command; merely calling a benign command with a trailing ';' can launch arbitrary shell commands.

The affected software is mac-shell-mcp, developed by cfdude. Versions older than 2.0.0 allow the injection described. No additional affected products or specific patch versions are enumerated in the advisory, so any deployments of pre-2.0.0 releases are at risk.

The CVSS score of 8.5 signals a high severity and indicates that exploitation can occur once a client is able to send crafted execute_command payloads. Based on the description, the likely attack vector is remote over a network connection. While no EPSS score is available, the lack of a KEV listing does not diminish the importance of applying a fix promptly. Attackers could potentially trigger the vulnerability by sending a prompt containing a malicious argument or modifying an existing prompt on the client side, then having the server execute unintended commands.