mcp-shell previously disabled security features by default, and a configuration mistake left Security.Enabled set to false in versions earlier than 0.6.0. When the environment variable MCP_SHELL_SEC_CONFIG_FILE is not supplied, the program starts in a bare-binary deployment that skips security policy validation. Consequently, the SecurityValidator.validateCommand function bypasses all checks, permitting any shell command supplied through the shell_exec MCP tool to be run with the privileges of the mcp-shell process user. This flaw represents an operating‑system command injection vulnerability (CWE‑78) that can lead to complete compromise of the host system. The in‑documentation default of a missing configuration file means many installations, especially those built from source or using the README‑guided deployment, are exposed by default.

The affected product is mcp-shell developed by sonirico. Versions prior to 0.6.0 implement the broken logic. The vulnerability specifically impacts deployments that omit the MCP_SHELL_SEC_CONFIG_FILE environment variable, a scenario documented in the README and client configuration guidance.

The CVSS score of 8.6 marks this as a high‑severity issue, indicating substantial impact if exploited. No EPSS score is available, so the current probability of exploitation cannot be quantified. This vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or through a compromised LLM connection over stdio, as the flaw hinges on an attacker supplying commands to the shell_exec tool via that interface. The potential consequences include arbitrary command execution, data exfiltration, or system takeover, depending on the privileges of the mcp-shell process.