LibreChat MCP STDIO Argument Injection (CVE-2026-22252)
LibreChat's MCP STDIO adapter passes tool arguments straight into a spawned process without quoting or escaping them. An attacker who controls tool input can smuggle shell metacharacters or extra command-line flags into that call, turning a normal tool invocation into arbitrary command execution.
How the attack works
An attacker crafts a tool call where the argument value contains shell metacharacters, command substitution syntax like $(id), or newline-separated fake flags such as --exec=. LibreChat's MCP STDIO adapter forwards this argument unmodified to child_process.spawn. Because the argument is not quoted or sanitized, the spawned process (or the underlying shell) interprets the injected content as additional commands or options rather than as a literal string. This lets the attacker run commands or alter the tool's behavior with the permissions of the process that spawned it.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 91eec57f-31c9-4d72-8fda-6d9ccc1f43e9
- Severity
- High
Why it matters
An attacker can execute arbitrary commands on the host running the MCP tool, potentially reading files, exfiltrating data, or pivoting further into the environment — all through what looks like a normal tool call.
What you can do
- →Upgrade or patch LibreChat's MCP STDIO adapter so tool arguments are passed as an argv array rather than concatenated into a shell string.
- →Validate and reject tool arguments containing shell metacharacters (;, |, $, `, &&) or newline-based flag injection before they reach spawn.
- →Run MCP tool processes with least privilege and without shell interpretation (avoid shell:true in spawn calls).
- →Audit logs for tool arguments containing suspicious sequences like $(...), backticks, or unexpected --flag= patterns.
Known benign look-alikes
- MCP server documentation showing example tool args that contain quotation marks or escaped strings.
- Code search hits in security tooling that scan for the CVE-2026-22252 PoC pattern.
- Skill snippets demonstrating shell-quoting libraries in educational context.