high · 8.4CVE-2026-55157Aug 14, 2026

CVE-2026-55157: @ooples/token-optimizer-mcp OS Command Injection via smart_user username

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A crafted username passed to the smart_user tool's get-user-info operation is interpolated directly into a shell command, letting any MCP client run arbitrary OS commands as the server's process…

Package@ooples/token-optimizer-mcp
Ecosystemnpm
Affected< 5.1.0
Fixed in5.1.0
CVE-2026-55157: @ooples/token-optimizer-mcp OS Command Injection via smart_user username

The problem

The smart_user tool in @ooples/token-optimizer-mcp accepts a caller-controlled username argument and splices it directly into a shell string passed to execAsync():

`` getent passwd "${username}" || grep "^${username}:" /etc/passwd ``

Double-quoting the value does not prevent exploitation. POSIX shells still evaluate $(...) and backtick expressions inside double quotes, so the injected command runs before getent or grep ever sees its arguments.

The impact is arbitrary command execution with the privileges of the process running the MCP server. No authentication is required beyond the ability to call the smart_user tool.

Proof of concept

A working proof-of-concept for CVE-2026-55157 in @ooples/token-optimizer-mcp, with the exact payload below.

json
// MCP JSON-RPC tool call (sent over stdio)
{
  "jsonrpc": "2.0",
  "id": "poc",
  "method": "tools/call",
  "params": {
    "name": "smart_user",
    "arguments": {
      "operation": "get-user-info",
      "username": "$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_PWNED)",
      "useCache": false
    }
  }
}

The shell receives the command string getent passwd "$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_PWNED)" and evaluates the $(...) substitution before passing any argument to getent. This is a textbook CWE-78 injection: user input is concatenated into a shell command string rather than being passed as a discrete argument via a spawn API (e.g., Node's execFile with an args array), so shell metacharacters are interpreted by the OS.

The fix in commit b4ee96dac799cbfba0a9f9c17844ce9d613cbcc7 (v5.1.0) replaces string interpolation with a validated, allowlist approach or moves to a spawn-style API that never involves a shell, making the injected $() literal text rather than an evaluated expression.

The fix

Upgrade @ooples/token-optimizer-mcp to **v5.1.0** or later. The patch (commit b4ee96dac799cbfba0a9f9c17844ce9d613cbcc7) removes shell interpolation of the username argument in the smart_user / get-user-info code path. If an immediate upgrade is not possible, restrict which MCP clients can invoke the smart_user tool, or disable the get-user-info operation until the package is updated.

Reporter not attributed.

References: [1][2][3][4]

Related research