# MCP stdio server config command injection via unvalidated test endpoints

- **Severity:** High
- **Signature ID:** `d6255bed-b9c9-4ffb-99e6-519d327b967b`
- **CVEs:** CVE-2026-42271
- **MITRE ATLAS:** AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI05 (Cascading Failures in Multi-Agent Systems), LLM06 (Excessive Agency)

## Summary

Some AI agent platforms let a request supply an MCP 'stdio' server configuration (a command plus arguments to run). If that configuration isn't validated, an attacker can put a shell interpreter or a code-execution flag straight into it, and the platform will execute it on the host. This turns an ordinary API request into arbitrary command execution.

## How the attack works

The attacker sends a request to an endpoint that accepts an MCP stdio server configuration — for example a test or setup endpoint. Instead of a legitimate program path, the command field is set to a shell (sh, bash, cmd) or contains shell metacharacters, or the arguments include a code-execution flag like -c or -e followed by attacker-controlled code. The platform spawns this command as a subprocess to run the 'MCP server', treating attacker input as a program to execute rather than data. This gives the attacker code execution in the context of the host running the agent platform.

## Why it matters

An attacker gets arbitrary command execution on the server hosting the agent platform, which can lead to data theft, lateral movement, or full host compromise — from a single unauthenticated or lightly authenticated API call.

## What you can do

- Never pass user-supplied or agent-supplied values directly into a process command/args field; validate against an allowlist of known-safe MCP server binaries and paths.
- Reject any MCP server configuration whose command is a shell interpreter (sh, bash, cmd, powershell) or contains shell metacharacters (;, |, &, `, $()).
- Reject arguments containing code-execution flags (-c, -e, --eval) unless explicitly required and reviewed.
- Run any endpoint that accepts MCP stdio configs with least privilege and monitor for unexpected subprocess spawns from it.

## Known benign look-alikes

- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00567
- https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g
- https://nvd.nist.gov/vuln/detail/CVE-2026-42271
- https://github.com/advisories/GHSA-v4p8-mg3p-g94g

---
Source: https://www.netzilo.com/threats/atr-mcp-stdio-server-config-command-injection-via-unvalidated-te