CVE-2026-55582: mcp-shell Git Alias RCE Vulnerability

CVE-2026-55582 Overview

CVE-2026-55582 is a command injection vulnerability in mcp-shell, a Model Context Protocol (MCP) server designed to execute shell commands securely and auditably. Versions prior to 0.6.0 ship a default security.yaml that allow-lists /usr/bin/git while the validator in security.go fails to treat ! as a shell metacharacter and applies no per-executable argument policy. Any caller of the shell_exec MCP tool can abuse Git's alias feature to run arbitrary operating system commands as the mcp-shell process user. The default Docker image ships with Git installed, secure mode enabled, and the mcpuser account, making the bypass exploitable out of the box.

Critical Impact
An attacker with MCP connectivity can execute arbitrary OS commands as mcpuser in the default Docker deployment without any additional authentication.

Affected Products

mcp-shell versions prior to 0.6.0
Default mcp-shell Docker image with Git installed and secure mode enabled
MCP integrations that expose the shell_exec tool using the shipped security.yaml

Discovery Timeline

2026-08-25 - CVE-2026-55582 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55582

Vulnerability Analysis

The flaw is a Command Injection weakness (CWE-78) in the mcp-shell executable allow-list model. The default configuration permits /usr/bin/git, and the argument validator omits ! from both containsShellMetacharacters and containsDangerousShellConstructs. Git treats an alias value beginning with ! as a shell command to execute. When the MCP client supplies /usr/bin/git -c alias.pwn=!<arbitrary-command> pwn, Git registers the alias in-process and immediately invokes it through /bin/sh -c. The allow-list therefore fails to constrain what code actually runs.

Root Cause

Two design defects combine to produce the bypass. First, the validator's metacharacter denylist does not include !, so alias payloads pass argument inspection. Second, mcp-shell applies no per-executable argument policy, meaning it does not restrict which Git subcommands, flags, or -c overrides are permitted. The SecurityConfig struct in config.go exposes an AllowedExecutables list but no mechanism to constrain arguments passed to those executables.

Attack Vector

The attack requires only MCP connectivity to the mcp-shell server. A caller invokes the shell_exec tool with a command argument that leverages Git's -c alias.<name>=!<cmd> syntax. Git parses the -c override, creates the shell alias, and executes the attacker-controlled payload as the mcp-shell process user (mcpuser in the default image). Because secure mode is enabled by default, defenders may reasonably assume the allow-list is enforced when it is not.

The following patch excerpt from the fix in version 0.6.0 shows the SecurityConfig struct that governs allow-listing. The upstream remediation keeps interpreters and shell wrappers out of the allow-list and makes secure mode the default:

type SecurityConfig struct {
    Enabled            bool          `yaml:"enabled"`
    AllowedCommands    []string      `yaml:"allowed_commands"`    // Deprecated: use AllowedExecutables
    BlockedCommands    []string      `yaml:"blocked_commands"`    // Deprecated: use validation instead
    BlockedPatterns    []string      `yaml:"blocked_patterns"`    // Deprecated: use validation instead
    AllowedExecutables []string      `yaml:"allowed_executables"` // Secure: list of allowed executable paths
    MaxExecutionTime   time.Duration `yaml:"max_execution_time"`
    WorkingDirectory   string        `yaml:"working_directory"`
    RunAsUser          string        `yaml:"run_as_user"`
    MaxOutputSize      int           `yaml:"max_output_size"`
    AuditLog           bool          `yaml:"audit_log"`
    UseShellExecution  bool          `yaml:"use_shell_execution"` // Legacy mode - enables shell execution (DANGEROUS)
}
// Source: https://github.com/sonirico/mcp-shell/commit/f31377fce6ec31114e5a4398c0e5270552bce09f

Detection Methods for CVE-2026-55582

Indicators of Compromise

Process events showing git invoked with -c alias.<name>=!<command> argument patterns.
Child processes of the mcp-shell binary that are not standard Git helpers (for example, /bin/sh, curl, wget, nc, or an interpreter such as python, bash).
Outbound network connections initiated by the mcpuser account to attacker-controlled hosts.
mcp-shell audit log entries containing git -c alias. followed by =! in command arguments.

Detection Strategies

Monitor container and host process trees for git executions where the command line contains the literal substring alias. combined with =!.
Alert on any child process of mcp-shell outside a known-good allow-list of Git subprocesses.
Correlate MCP tool-call telemetry with subsequent shell activity under the mcpuser identity to expose tool-driven command execution.

Monitoring Recommendations

Enable and centrally forward the mcp-shell audit log so shell_exec invocations are searchable.
Baseline expected process behavior for MCP servers and alert on deviations, especially interpreters spawned by AI-tool backends.
Track upgrades of mcp-shell deployments to confirm all instances run version 0.6.0 or later.

How to Mitigate CVE-2026-55582

Immediate Actions Required

Upgrade mcp-shell to version 0.6.0 or later on every host and container image in use.
Remove /usr/bin/git and any other interpreter or wrapper capable of invoking a shell from allowed_executables.
Restrict network reachability to the mcp-shell MCP endpoint so only trusted clients can call shell_exec.
Rotate any secrets accessible to the mcpuser account if exploitation is suspected.

Patch Information

The fix is available in mcp-shell release v0.6.0. The corresponding change is documented in Pull Request #16 and commit f31377f, and full details are provided in GitHub Security Advisory GHSA-74hp-mggr-hv58. The patch makes secure mode the default and keeps interpreters out of the allow-list.

Workarounds

Edit security.yaml to remove /usr/bin/git and other shell-capable binaries from allowed_executables until the upgrade is applied.
Disable the shell_exec MCP tool or the entire mcp-shell service in environments where an upgrade path is delayed.
Run mcp-shell as an unprivileged user in an isolated container with no outbound network access and read-only filesystems where feasible.

bash

# Minimal hardened security.yaml example (post-upgrade)
security:
  enabled: true
  use_shell_execution: false
  allowed_executables:
    - /usr/bin/ls
    - /usr/bin/cat
  max_execution_time: 5s
  max_output_size: 65536
  audit_log: true