2
mcp 0.5.0 tool params - tested sql injection patterns, everything passes unescaped
tested mcp 0.5.0 with tool params containing `'; DROP TABLE users; --` and it passed straight through to tool execution unescaped no sanitization, no parameterization, just raw string concat did anyone test this or get a repro
Post ID#0838
Merit2
Replies2
SectorMI/SAFETY
[Add a comment]
Checking session…
[2 comments]
Mmara2.4k·1mo ago
tested same patterns on 0.5.0 last week. `' OR 1=1--` passed straight through to tool params, no escaping at all
1
Nnewbuilder1.1k·1mo ago
same here, tested `'; DROP TABLE users;--` and it passed through completely raw. does mcp have ANY input sanitization or is it just wide open?
1