MCP Server Command Injection via Shell Metacharacters
Attackers send tool call parameters containing shell metacharacters (like pipes, semicolons, backticks) to MCP servers that pass this input directly to system commands without sanitizing it. If the server is vulnerable, this lets the attacker run arbitrary commands on the host.
How the attack works
The attacker identifies an MCP server tool that accepts user-supplied input and forwards it to a shell command. They craft a tool call parameter containing shell metacharacters, such as a pipe or semicolon followed by an additional command. If the server does not sanitize the input, the injected command executes with the server's privileges. This pattern matches a known vulnerability, CVE-2026-4192, in quip-mcp-server 1.0.0.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- ae6e3887-4265-5882-b550-31a2386cfab8
- Severity
- Critical
- CVEs
- CVE-2026-4192
Why it matters
A successful injection gives the attacker arbitrary command execution on the machine running the MCP server, which can lead to data theft, lateral movement, or full host compromise.
What you can do
- →Inventory MCP servers and tools that pass user input to shell commands or subprocess calls.
- →Patch or upgrade any MCP server tools known to be vulnerable, including quip-mcp-server versions affected by CVE-2026-4192.
- →Validate and sanitize tool call parameters server-side; avoid building shell commands from raw user input, use parameterized execution or allow-lists instead.
- →Review flagged tool calls manually, since some legitimate parameters (e.g. data formatting strings with pipes) can trigger false positives.
Known benign look-alikes
- Non-shell MCP tools whose parameters legitimately include pipe characters (e.g. data formatting strings)