mcp-shell is an MCP server that runs shell commands securely, auditably, and on demand. Before 0.6.0, the default security.yaml permits /usr/bin/git, and security.go omits the '!' from containsShellMetacharacters and containsDangerousShellConstructs while applying no per‑executable argument policy. A caller of the shell_exec MCP tool can supply /usr/bin/git -c alias.pwn=!<arbitrary-command>, leading Git to create a shell alias that executes that arbitrary command as the mcp-shell process user. The default Docker image runs as the non‑root user mcpuser with Git installed and secure mode enabled, making the bypass exploitable without additional authentication beyond MCP connectivity. This flaw is a classic OS command injection (CWE‑78) that enables remote code execution with the privileges of the mcp-shell service.

The vulnerability exists in versions of sonirico:mcp-shell prior to 0.6.0. The default Docker image runs as the non‑root user mcpuser and ships with Git installed and secure mode enabled, so the bypass is exploitable in the default deployment without additional authentication beyond MCP connectivity. This issue is fixed in version 0.6.0.

The CVSS score is 8.4, indicating a high severity. The EPSS score is not available, so the current post‑release exploitation probability is uncertain, but the fact that the flaw is enabled by default in a Docker image that requires no external authentication suggests that an attacker with MCP connectivity can exploit it immediately. The vulnerability is not listed in the CISA KEV catalog yet, but the public advisory and raw commit references indicate that the issue is known and fixable in the next release.