# Upsonic MCP Command Allowlist Bypass RCE (CVE-2026-30625)

- **Severity:** High
- **Signature ID:** `bdbdb524-2b85-4774-b424-9c82c6c4f471`
- **CVEs:** CVE-2026-30624, CVE-2026-30625
- **MITRE ATLAS:** AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI04 (Memory and Context Poisoning), ASI05 (Cascading Failures in Multi-Agent Systems), LLM05 (Improper Output Handling), LLM06 (Excessive Agency)

## Summary

Upsonic's MCP server configuration lets whoever controls it specify the command that gets launched as a subprocess. Although Upsonic claims to only allow safe launchers like npx, uvx, or python -m, it never actually checks this at the point where the command runs, so an attacker who can edit that configuration can put a shell or interpreter with an inline-execute flag there instead and run arbitrary code.

## How the attack works

An attacker gains the ability to write or modify an Upsonic MCP server configuration, for example through a compromised config file, a supply-chain injection, or a poisoned agent context. Instead of a safe launcher like npx or python -m, they set the 'command' field to a shell binary (bash, sh) or a network tool, and add an inline-exec flag such as -c or -e to the 'args'. When Upsonic spawns the MCP server subprocess, it passes this command straight to subprocess/anyio.open_process without checking it against its own allowlist. The attacker's shell command executes with whatever privileges the Upsonic process has.

## Why it matters

An attacker who can influence MCP server configuration gets arbitrary code execution on the host running Upsonic, which can lead to full compromise of the agent's environment, data, and any credentials it has access to.

## What you can do

- Treat MCP server configuration files as sensitive: restrict who and what can write to them, and put them under version control with review.
- Independently validate 'command' and 'args' fields against an allowlist outside of Upsonic itself before the config is loaded, since Upsonic's own check is not enforced at execution time.
- Watch for MCP configs where 'command' is a shell (bash, sh) or network tool, or where args contain -c/-e alongside an interpreter, and treat these as high-risk.
- Run Upsonic-spawned MCP subprocesses with least-privilege accounts and no unnecessary network or filesystem access, to limit damage if a malicious command slips through.

## Known benign look-alikes

- Legitimate Upsonic MCP configs using npx/uvx/python -m with safe package names.
- Security advisory text quoting CVE-2026-30625 payloads.
- MCP configs with non-shell commands (e.g., npx, uvx) and no inline-exec flags.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00542
- https://nvd.nist.gov/vuln/detail/CVE-2026-30625

---
Source: https://www.netzilo.com/threats/atr-upsonic-mcp-command-allowlist-bypass-rce-cve-2026-30625