> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Command injection

> Tool parameters flow directly into system commands without sanitization.

Tool parameters flow directly into system commands without sanitization.

## How to resolve

**Use parameterized command execution**: Replace shell string construction with array-based command execution that separates the command from arguments (e.g., `subprocess.run(["command", arg])` instead of `os.system(f"command {arg}")`).

**Validate and sanitize input**: If shell execution is unavoidable, strictly validate input against an allowlist of permitted characters and escape shell metacharacters.

**Avoid shell interpretation**: Use language-specific APIs that bypass the shell entirely, such as Python's `subprocess` with `shell=False`.

**Apply least privilege**: Run MCP server processes with minimal permissions to limit the impact of successful command injection attacks.

## Risk

**Governance/Compliance**

Command injection vulnerabilities violate multiple security standards:

* **OWASP Top 10 (A03:2021 - Injection):** Allows untrusted data to be sent to an interpreter as part of a command, leading to unintended execution.
* **CWE-78 (OS Command Injection):** Improper neutralization of special elements used in OS commands enables attackers to execute unauthorized commands.
* **NIST SP 800-53 (SI-10):** Fails to validate information inputs, allowing malicious command sequences to bypass security controls.
* **OWASP MCP Top 10 (MCP05:2025 - Command Injection & Execution):** MCP servers constructing commands from untrusted input are vulnerable to arbitrary command execution.

**Security**

An attacker can execute arbitrary system commands on the server hosting the MCP service, potentially gaining full control of the underlying system. This could lead to data exfiltration, system compromise, lateral movement within the network, or deployment of malware. The impact is especially severe in MCP contexts where the server may have elevated privileges or access to sensitive resources.

## Explanation

Command injection occurs when MCP tool parameters flow directly into system commands without proper sanitization, allowing attackers to execute arbitrary shell commands. The scanner detects patterns where string concatenation or formatting is used to construct shell commands from user-controlled input. This vulnerability can be prevented by using parameterized command execution (like subprocess with array arguments) instead of shell string interpolation.

## Specifications

**Trigger**

* MCP server scan detects shell command construction patterns using string concatenation or formatting with user-controlled tool parameters

**Severity**

* CRITICAL

**Applies to**: MCP Server