MCP STDIO Config Shell Injection

How the attack works

An attacker supplies or tampers with an MCP server configuration so that its STDIO 'command' field points to a shell binary instead of a legitimate executable. Because the shell is invoked directly as the launcher, any arguments or environment passed alongside it get interpreted as shell commands rather than as safe program arguments. This lets an attacker smuggle in arbitrary commands that run with whatever privileges the MCP host process has. It is the root technique behind a cluster of related CVEs, including one variant that abuses a transport-type downgrade to reach the same shell-launch condition.

Netzilo detection

Why it matters

If exploited, this gives an attacker arbitrary command execution on the machine running the MCP host, which can lead to full compromise of the agent's environment, data theft, or lateral movement — not just misuse of the AI agent itself.

What you can do

• →Review all MCP server configs and confirm the 'command' field points to a specific vetted executable, never a shell (bash, sh, cmd, powershell, etc.).
• →Treat any MCP config sourced from an untrusted repo, package, or user submission as hostile until reviewed.
• →Restrict who can add or edit MCP configurations, and require code review for changes to them.
• →Watch for transport-type fields being silently changed in configs, since that has been used to downgrade into the vulnerable shell-launch path.

Known benign look-alikes

• Security research discussing CVEs or the attack pattern
• Test fixtures containing these patterns as data
• Documentation explaining the attack

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-30623
• https://nvd.nist.gov/vuln/detail/CVE-2026-26015

Related threats