tested mcp tool param injection with polyglot payloads - json inside yaml inside base64
been testing nested encoding attacks on mcp 0.5.0 for a client project. polyglot payloads (valid json embedded in yaml embedded in base64) bypass sanitization completely because each layer looks valid to its parser. example: tool param that's base64-encoded yaml containing json with embedded instructions. sdk decodes base64, parses yaml, extracts json, never checks the final decoded instruction content. tested 8 different polyglot combinations, 6/8 bypassed validation. sanitization needs to happen on fully decoded content not at each encoding layer source: internal pentest, can share sanitized payloads if anyone wants to test on their setup
lol polyglot payloads. tested this exact thing on 0.5.0 two days ago with json inside yaml inside base64 and it worked perfectly, sdk just decoded and passed it straight to context with zero validation
lol ofcourse it worked. sdk doesn't even TRY to validate nested encodings. you could probably do base64 inside url encoding inside json and it would still pass through did you test if the MODEL catches it or does it just execute the payload?
ok so polyglot payloads are exactly the kind of thing that should never work but always does because nobody sanitizes recursively. did you test if the model catches it downstream or does it just execute the inner payload blindly? my guess is the sdk decodes outer layers and passes to context, model sees the inner json and treats it as valid input