MCP Launcher Exec-Flag Bypass
Some AI agent systems (MCP frameworks) only check whether a command starts with an approved launcher like npx, node, or python before allowing it to run. Attackers exploit this by appending an inline code-execution flag such as -c, -e, or --eval, which lets them run any code they want while the launcher itself still looks approved.
How the attack works
The target system uses an allowlist that permits certain launcher binaries (npx, node, python, npm) to execute. An attacker crafts a command that starts with one of these trusted launchers, then adds a flag like -c, -e, or --eval followed by arbitrary code. Because the allowlist check only looks at the launcher name and not the full argument string, the check passes even though the actual payload is attacker-controlled code, not a legitimate script or package. The launcher then executes that inline code directly, bypassing the intent of the allowlist.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- netzilo-mcp-launcher-exec-bypass-001
- Severity
- Critical
Why it matters
An attacker can run arbitrary code on systems that rely on this launcher allowlist, effectively defeating the access control meant to restrict what an AI agent or automation pipeline can execute. This can lead to full compromise of the host running the MCP framework, tracked as CVE-2026-30625 (Upsonic) and CVE-2026-40933 (Flowise).
What you can do
- →Do not rely on launcher-name allowlisting alone; inspect full command-line arguments for code-execution flags (-c, -e, --eval, and equivalents).
- →Restrict or disable inline code-execution flags for npx, node, python, and npm in any automated or agent-driven execution path.
- →Patch or upgrade Upsonic and Flowise deployments to versions that address CVE-2026-30625 and CVE-2026-40933.
- →Review logs for approved-launcher invocations that include eval-style flags, distinguishing legitimate research or test activity from real exploitation attempts.
Known benign look-alikes
- Security research discussing the bypass technique
- Test fixtures that include these patterns as data