CVE-2026-85660: cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution
cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the validatecommandwithoperators function when ALLOWSHELLOPERATORS is enabled. Attackers can use shell command substitution syntax like $(...) or backticks to execute non-allowlisted commands that bypass the ALLOWEDCOMMANDS validation check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cli-mcp-serverto a version that resolves this vulnerability.Fixed in 0.2.5 - Configuration
Disable ALLOW_SHELL_OPERATORS to prevent command allowlist bypass via shell command substitution syntax ($(…) or backticks) in _validate_command_with_operators.
cli-mcp-server ALLOW_SHELL_OPERATORS = disabled
Event History
Frequently Asked Questions
Which deployments are affected by this bypass?
The issue affects cli-mcp-server 0.2.5 deployments where ALLOW_SHELL_OPERATORS is enabled. The provided information does not establish whether this setting is enabled by default.
What does an attacker need to exploit the issue?
An attacker must be able to submit a command processed by the vulnerable command-validation function while shell operators are allowed. They can embed a non-allowlisted command using shell substitution syntax such as $(...) or backticks.
What is the impact of successful exploitation?
Successful exploitation allows execution of commands that are not permitted by the ALLOWED_COMMANDS validation check. The reported severity vector indicates potential high impact to confidentiality, integrity, and availability.