CVE-2026-85660
cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with_operators function when ALLOW_SHELL_OPERATORS is enabled. Attackers can use shell command substitution syntax like $(...) or backticks to execute non-allowlisted commands that bypass the ALLOWED_COMMANDS validation check.
वीकनेस
cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with_operators function when ALLOW_SHELL_OPERATORS is enabled. Attackers can use shell command substitution syntax like $(...) or backticks to execute non-allowlisted commands that bypass the ALLOWED_COMMANDS validation check.
संदर्भ
- https://github.com/MladenSU/cli-mcp-server
- https://github.com/MladenSU/cli-mcp-server/blob/main/src/cli_mcp_server/server.py
- https://github.com/MladenSU/cli-mcp-server/issues/17
- https://www.vulncheck.com/advisories/cli-mcp-server-0.2.5-command-allowlist-bypass-via-shell-substitution
- https://github.com/MladenSU/cli-mcp-server/issues/17
हमलावर से पहले बग आप ढूँढें।
GitHub से साइन इन करें और एक मिनट से भी कम में अपना पहला ऑडिट चलाएँ। फ़्री प्लान के लिए क्रेडिट कार्ड की ज़रूरत नहीं।