The description mentions that mcp-shell, before version 0.6.0, includes /bin/bash in its default Docker security.yaml allowlist. The validation logic in security.go only checks the first token of a command, and checkBlockedPatternsAndCommands does not block the shell command‑mode flag –c. Consequently, a caller of the shell_exec tool can supply the command `/bin/bash -c <arbitrary‑command>`, which passes validation, reaches executor.go, and is executed by exec.CommandContext as the mcpuser account. This bypasses the intended allowlist and allows an attacker to run arbitrary commands with the privileges of mcpuser, a clear remote code execution flaw that was fixed in version 0.6.0.

The issue affects installations of sonirico mcp-shell prior to version 0.6.0. In the default Docker configuration, /bin/bash is included in allowed_executables and the bug resides in security.go and executor.go, allowing the bypass.

The CVSS score of 8.4 classifies this as a high‑severity exploit. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. An adversary who can invoke shell_exec on the running MCP server—by accessing the related API endpoint or other communication channel—may choose any shell command to execute. The exploit requires only that the attacker can supply a command string; no additional privilege escalation beyond mcpuser is needed, making it both highly impactful and potentially easy to deploy once the service is exposed.