Token Optimizer MCP allows an attacker to execute arbitrary shell commands by supplying a crafted username to the get-user-info operation of the smart_user tool. The injected commands run with the privileges of the user that runs the token-optimizer-mcp server, enabling complete compromise of that host. This flaw is enumerated as CWE-78 (OS Command Injection) and can lead to full system takeover if the server user is privileged.

The vulnerability affects the token-optimizer-mcp product from ooples, specifically any deployment with a server version older than 5.1.0. All 16 CLI clients that communicate with the server are potentially able to trigger the command injection by calling the smart_user tool. Versions 5.1.0 and later have the issue fixed.

The CVSS score of 8.4 signals a high severity and indicates that both confidentiality, integrity, and availability are at risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation at the time of this analysis. The likely attack vector is via any MCP client that can invoke the smart_user tool; this requires network access to the server and knowledge of the get‑user‑info command. Since the injection occurs in a user-supplied argument, exploitation is straightforward if the attacker can reach the relevant endpoint.