cli-mcp-server 0.2.5 contains a flaw in the _validate_command_with_operators function that allows attackers to use shell command substitution syntax such as $(...) or backticks to bypass the ALLOWED_COMMANDS check. This bypass permits the execution of arbitrary commands that are not in the allowlist, leading to full remote code execution and compromising both confidentiality and integrity of the affected system.

The vulnerable component is the MladenSU:cli-mcp-server product, specifically version 0.2.5. Only this version is documented as affected.

The CVSS score of 9.2 classifies this flaw as critical, indicating a high likelihood of successful exploitation and severe impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote, where an attacker with input authority can supply malicious command strings; the vulnerability is exploitable only if ALLOW_SHELL_OPERATORS is enabled, and no additional system compromises or privileged access are required beyond the ability to send commands to the server.