Skip to main content
Tool parameters flow directly into system commands without sanitization.

​
How to resolve

Use parameterized command execution: Replace shell string construction with array-based command execution that separates the command from arguments (e.g., subprocess.run(["command", arg]) instead of os.system(f"command {arg}")). Validate and sanitize input: If shell execution is unavoidable, strictly validate input against an allowlist of permitted characters and escape shell metacharacters. Avoid shell interpretation: Use language-specific APIs that bypass the shell entirely, such as Python’s subprocess with shell=False. Apply least privilege: Run MCP server processes with minimal permissions to limit the impact of successful command injection attacks.

​
Risk

Governance/Compliance Command injection vulnerabilities violate multiple security standards:
  • OWASP Top 10 (A03:2021 - Injection): Allows untrusted data to be sent to an interpreter as part of a command, leading to unintended execution.
  • CWE-78 (OS Command Injection): Improper neutralization of special elements used in OS commands enables attackers to execute unauthorized commands.
  • NIST SP 800-53 (SI-10): Fails to validate information inputs, allowing malicious command sequences to bypass security controls.
  • OWASP MCP Top 10 (MCP05:2025 - Command Injection & Execution): MCP servers constructing commands from untrusted input are vulnerable to arbitrary command execution.
Security An attacker can execute arbitrary system commands on the server hosting the MCP service, potentially gaining full control of the underlying system. This could lead to data exfiltration, system compromise, lateral movement within the network, or deployment of malware. The impact is especially severe in MCP contexts where the server may have elevated privileges or access to sensitive resources.

​
Explanation

Command injection occurs when MCP tool parameters flow directly into system commands without proper sanitization, allowing attackers to execute arbitrary shell commands. The scanner detects patterns where string concatenation or formatting is used to construct shell commands from user-controlled input. This vulnerability can be prevented by using parameterized command execution (like subprocess with array arguments) instead of shell string interpolation.

​
Specifications

Trigger
  • MCP server scan detects shell command construction patterns using string concatenation or formatting with user-controlled tool parameters
Severity
  • CRITICAL
Applies to: MCP Server