high · 8.4CVE-2026-55582Aug 25, 2026

CVE-2026-55582: mcp-shell Secure Mode Allowlist Bypass via Git Shell Alias

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

mcp-shell's secure mode can be completely bypassed by passing a Git command with a shell alias argument, letting any MCP client run arbitrary OS commands even when the allowlist is active.

Packagegithub.com/sonirico/mcp-shell
Ecosystemgo
Affected< 0.6.0
Fixed in0.6.0
CVE-2026-55582: mcp-shell Secure Mode Allowlist Bypass via Git Shell Alias

The problem

mcp-shell exposes a shell_exec MCP tool that validates commands against an allowlist of executables and a set of blocked metacharacters. The default Docker image ships with /usr/bin/git in allowed_executables and blocked_patterns: [].

The metacharacter blocklist in security.go (containsShellMetacharacters) covers |&;<>(){}[]$\ but omits !. Git treats -c alias.NAME=!CMD as a runtime config entry that runs CMD as a shell command when the alias name is used as a subcommand, so every check passes and arbitrary code executes as the mcpuser` process (UID 1000).

Proof of concept

A working proof-of-concept for CVE-2026-55582 in github.com/sonirico/mcp-shell, with the exact payload below.

json
{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "shell_exec",
    "arguments": {
      "command": "/usr/bin/git -c alias.pwn=!touch pwn /tmp/mcp-shell-mcp-poc",
      "base64": false
    }
  }
}

The validator in security.go:136 checks containsShellMetacharacters against |&;<>(){}[]$\ but ! is absent from the set. containsDangerousShellConstructs also misses it. Both functions return false for alias.pwn=!touch`, so validation passes.

The executor calls exec.CommandContext(ctx, "/usr/bin/git", "-c", "alias.pwn=!touch", "pwn", "/tmp/mcp-shell-mcp-poc"). Git interprets -c alias.pwn=!touch as a runtime config alias, then resolves the pwn subcommand by running sh -c 'touch "$@"' _ /tmp/mcp-shell-mcp-poc.

The patch (commit f31377f, v0.6.0) adds ! to the blocked metacharacter set, adds a alias.*=! blocked argument pattern, and removes git from the default allowed_executables with an explicit startup warning that flags any alias-capable tool placed in the allowlist.

The fix

Upgrade to mcp-shell v0.6.0. Remove git (and any other alias-capable or interpreter-style binary) from allowed_executables in your security.yaml. The patched default config no longer includes git and warns at startup if such a binary is detected in the allowlist.

Reporter not attributed.

References: [1][2][3][4][5]

Related research