# LibreChat MCP STDIO Argument Injection (CVE-2026-22252)

- **Severity:** High
- **Signature ID:** `91eec57f-31c9-4d72-8fda-6d9ccc1f43e9`
- **CVEs:** CVE-2026-22252, CVE-2026-40933
- **MITRE ATLAS:** AML.T0040 (AI Model Inference API Access), AML.T0051.001 (Indirect)
- **OWASP:** ASI03 (Identity and Impersonation), ASI05 (Cascading Failures in Multi-Agent Systems), LLM01 (Prompt Injection), LLM05 (Improper Output Handling)

## Summary

LibreChat's MCP STDIO adapter passes tool arguments straight into a spawned process without quoting or escaping them. An attacker who controls tool input can smuggle shell metacharacters or extra command-line flags into that call, turning a normal tool invocation into arbitrary command execution.

## How the attack works

An attacker crafts a tool call where the argument value contains shell metacharacters, command substitution syntax like $(id), or newline-separated fake flags such as --exec=. LibreChat's MCP STDIO adapter forwards this argument unmodified to child_process.spawn. Because the argument is not quoted or sanitized, the spawned process (or the underlying shell) interprets the injected content as additional commands or options rather than as a literal string. This lets the attacker run commands or alter the tool's behavior with the permissions of the process that spawned it.

## Why it matters

An attacker can execute arbitrary commands on the host running the MCP tool, potentially reading files, exfiltrating data, or pivoting further into the environment — all through what looks like a normal tool call.

## What you can do

- Upgrade or patch LibreChat's MCP STDIO adapter so tool arguments are passed as an argv array rather than concatenated into a shell string.
- Validate and reject tool arguments containing shell metacharacters (;, |, $, `, &&) or newline-based flag injection before they reach spawn.
- Run MCP tool processes with least privilege and without shell interpretation (avoid shell:true in spawn calls).
- Audit logs for tool arguments containing suspicious sequences like $(...), backticks, or unexpected --flag= patterns.

## Known benign look-alikes

- MCP server documentation showing example tool args that contain quotation marks or escaped strings.
- Code search hits in security tooling that scan for the CVE-2026-22252 PoC pattern.
- Skill snippets demonstrating shell-quoting libraries in educational context.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00417
- https://nvd.nist.gov/vuln/detail/CVE-2026-22252

---
Source: https://www.netzilo.com/threats/atr-librechat-mcp-stdio-argument-injection-cve-2026-22252