mac-shell-mcp: OS command injection via execute_command arguments
Summary
mac-shell-mcp before 2.0.0 contains an OS command injection flaw that lets MCP clients bypass the command allowlist by placing shell metacharacters in execute_command arguments. An attacker or a malicious prompt can call an allowed command such as pwd with crafted arguments to run forbidden commands as the server user, without approval. The attack requires access to an MCP client session that uses the server, typically on a macOS workstation.
Affected
- cfdude mac-shell-mcp versions before 2.0.0 (CVE record: 0 to < 2.0.0)
- Exact lower bound of the affected range: Unknown.
Fixed in
- Version 2.0.0 or later (fix commit 932ce733cde07bb30b1f186303e6692dbb5d087a)
Workaround
- No vendor-published workaround found.
- If upgrading is not possible, remove or disable the server.
- Keep approval prompts enabled in the MCP client and review which commands the server may run.
- Run the server under a standard, low-privilege macOS account.
Exploitation
- No public proof of concept found.
- No evidence of in-the-wild exploitation; not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Upgrade every mac-shell-mcp installation to version 2.0.0 or later.
- Until the upgrade is done, disable the server or restrict it to trusted, non-sensitive directories.
- Check which macOS accounts run the server and which files, credentials and SSH keys they can reach.
- Review MCP client logs for unexpected command executions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-108953 at OSV osv.dev
- Fix commit 932ce733 github.com
- Vulnerable code in command-service.ts github.com
- mac-shell-mcp GitHub repository github.com
- mac-shell-mcp README github.com
- GitHub issue #45 github.com
- VulnCheck advisory www.vulncheck.com
- VulDB entry 416897 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:56.
Original description (NVD)
mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into execute_command arguments. Attackers or malicious prompts can call a safe command such as pwd with arguments like ';' to run forbidden commands as the server user without approval.
NVD references (5)
- https://github.com/cfdude/mac-shell-mcp
- https://github.com/cfdude/mac-shell-mcp/blob/1c1708201abb7a18c83075e1bf933e7a92cbeb9f/src/services/command-se…
- https://github.com/cfdude/mac-shell-mcp/commit/932ce733cde07bb30b1f186303e6692dbb5d087a
- https://github.com/cfdude/mac-shell-mcp/issues/45
- https://www.vulncheck.com/advisories/mac-shell-mcp-before-2.0.0-os-command-injection-via-execute-command-argu…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.