Critical 2026-07-11

Unsandboxed Command Execution via Dynamic MCP Server Config (command/args Injection)

Some AI platforms let admins or users register a 'custom MCP server' by supplying a command and arguments to run. If that input isn't properly restricted, an attacker can supply a command that spawns a shell, opens a reverse connection, or otherwise runs arbitrary code on the host with no sandboxing.

How the attack works

An attacker submits a custom MCP server configuration containing a 'command' and 'args' field, the format used by features like Flowise's Custom MCP integration. They either set the command directly to a shell or scripting binary (nc, bash, python, etc.) with arguments that open a reverse shell or execute arbitrary code, or they disguise the attack using an allowed binary with a bypass trick: 'docker build' pointed at a remote URL to fetch and run an attacker-controlled Dockerfile, 'npx --yes' as the long-flag equivalent of a blocked '-y' package install, or 'node //path' using a double-slash to slip past a filter that only checks for a single leading slash. Once accepted, the platform executes the command unsandboxed, giving the attacker code execution on the server.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID: cc4291ba-ee9c-4c57-ac17-0fe57472aebe
Severity: Critical
CVEs: CVE-2025-71336 CVE-2026-56274

Classification

AML.T0053 · AI Agent Tool Invocation ASI02 · Tool Misuse and Exploitation LLM08 · Vector and Embedding Weaknesses

Why it matters

Successful exploitation gives an attacker arbitrary command execution on the server hosting the AI agent platform, which can lead to full host compromise, credential theft, and lateral movement, especially if the endpoint accepting the configuration is unauthenticated by default.

What you can do

→Restrict or disable any 'bring your own MCP server' / custom command-based integration feature unless strictly necessary, and require authentication on the endpoint that accepts these configs.
→Validate command and argument fields against an allowlist of specific binaries and exact flag forms, not just short-flag patterns, and reject unrecognized long-flag aliases.
→Block 'docker build' calls that reference remote URLs, and flag any interpreter invocation ('bash -c', 'python -c', etc.) whose payload contains network-fetch, reverse-shell, or credential-access patterns.
→Run any MCP server processes in a sandbox or restricted execution environment so that even accepted configs cannot reach the host filesystem or network directly.

Known benign look-alikes

Legitimate MCP server configs using bash/sh/python with -c for a benign one-liner with no network-fetch/reverse-shell/credential-read/exec-obfuscation signal (e.g. "bash -c 'npm install && npm start'") — v2 requires the -c payload itself to contain a dangerous-vocabulary match, not just the bare interpreter+-c shape
docker build with a local Dockerfile path or build context (no https:// URL argument)
npx -y (short flag) for routine package execution — this rule only fires on the --yes long-flag alias
node invoked with a normal single-leading-slash absolute path or relative script name