CVE-2026-55582: mcp-shell has a Secure Mode Allowlist Bypass via Git Shell Alias

mcp-shell’s “secure mode” is designed to restrict command execution to an allowlist of executables defined in security.yaml. The default configuration includes /usr/bin/git. The security validator in security.go blocks common shell metacharacters (|&;<>(){}[]$\``) but omits !, which is the prefix Git uses to execute shell aliases (alias.NAME=!CMD). An attacker who can invoke the shell_execMCP tool can pass/usr/bin/git -c alias.pwn=!as the command argument, bypassing all validation and achieving arbitrary OS command execution as themcp-shellprocess user. The default Docker image runs asmcpuser` (UID 1000) with Git installed and secure mode enabled, making this exploitable in the default deployment with no authentication required.