CVE-2026-108953: mac-shell-mcp before 2.0.0 OS Command Injection via execute_command Arguments
mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into executecommand arguments. Attackers or malicious prompts can call a safe command such as pwd with arguments like ';' to run forbidden commands as the server user without approval.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An MCP client that can invoke execute_command can exploit it, including a client driven by a malicious prompt. The injected commands run with the privileges of the mac-shell-mcp server user.
Does the command whitelist prevent exploitation?
No. The vulnerability allows shell metacharacters in execute_command arguments to bypass the whitelist, so a permitted command such as pwd can be used to execute otherwise forbidden commands.
Which versions are affected?
Versions of mac-shell-mcp before 2.0.0 are affected.