MCP stdio server config command injection via unvalidated test endpoints
Some AI agent platforms let a request supply an MCP 'stdio' server configuration (a command plus arguments to run). If that configuration isn't validated, an attacker can put a shell interpreter or a code-execution flag straight into it, and the platform will execute it on the host. This turns an ordinary API request into arbitrary command execution.
How the attack works
The attacker sends a request to an endpoint that accepts an MCP stdio server configuration — for example a test or setup endpoint. Instead of a legitimate program path, the command field is set to a shell (sh, bash, cmd) or contains shell metacharacters, or the arguments include a code-execution flag like -c or -e followed by attacker-controlled code. The platform spawns this command as a subprocess to run the 'MCP server', treating attacker input as a program to execute rather than data. This gives the attacker code execution in the context of the host running the agent platform.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- d6255bed-b9c9-4ffb-99e6-519d327b967b
- Severity
- High
- CVEs
- CVE-2026-42271
Why it matters
An attacker gets arbitrary command execution on the server hosting the agent platform, which can lead to data theft, lateral movement, or full host compromise — from a single unauthenticated or lightly authenticated API call.
What you can do
- →Never pass user-supplied or agent-supplied values directly into a process command/args field; validate against an allowlist of known-safe MCP server binaries and paths.
- →Reject any MCP server configuration whose command is a shell interpreter (sh, bash, cmd, powershell) or contains shell metacharacters (;, |, &, `, $()).
- →Reject arguments containing code-execution flags (-c, -e, --eval) unless explicitly required and reviewed.
- →Run any endpoint that accepts MCP stdio configs with least privilege and monitor for unexpected subprocess spawns from it.
Known benign look-alikes
- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.