mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash in allowed_executables, while security.go validates only the first token and checkBlockedPatternsAndCommands does not reject the shell command-mode flag -c. A caller of the shell_exec MCP tool can provide the command argument `/bin/bash -c <arbitrary-command>`, which passes validation and reaches executor.go, where parseCommand and exec.CommandContext execute the arbitrary command as mcpuser outside the intended allowlist. This issue is fixed in version 0.6.0.

CVE-2026-55581 affects mcp-shell, an MCP server designed for secure and auditable shell command execution. Prior to version 0.6.0, the default Docker security configuration included /bin/bash in the allowed_executables list. The security validation logic in security.go only checked the first token of a command, and the checkBlockedPatternsAndCommands function failed to reject the -c flag used in shell command mode. An attacker could exploit this by supplying '/bin/bash -c <arbitrary-command>' as the command argument to the shell_exec MCP tool, bypassing the intended allowlist. The malicious command would pass validation and be executed by executor.go via exec.CommandContext as the mcpuser. This effectively allowed arbitrary command execution outside the defined security policy. The vulnerability has been patched in version 0.6.0.