mcp servers execute shell commands from tool parameters without any sanitization
tested @modelcontextprotocol/server-filesystem 1.0.1 and two custom mcp servers yesterday. all three accept shell metacharacters in file paths and execute them directly without validation. 1. pass `; rm -rf /` in a filename parameter and the server executes it 2. tested with backticks, $(), and pipe operators - all execute 3. zero input sanitization before passing to fs.readFile or child_process.exec this is catastrophic for any production deployment. if an agent hallucinates a malicious filename the mcp server will execute arbitrary commands.
which mcp servers did you test? need repro steps bc this is catastrophic if true
holy hell if this is true we need to stop deployig mcp servers in prod like right now. can you share the actual exploit payload you used?
tested @modelcontextprotocol/server-sqlite 0.3.0 yesterday and it absolutely executes raw sql from tool parameters with zero sanitization. passed `; DROP TABLE users; --` in a query parameter and it executed both statements