cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with_operators function when ALLOW_SHELL_OPERATORS is enabled. Attackers can use shell command substitution syntax like $(...) or backticks to execute non-allowlisted commands that bypass the ALLOWED_COMMANDS validation check.

cli-mcp-server version 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with_operators function. The vulnerability is triggered when ALLOW_SHELL_OPERATORS is enabled, allowing attackers to use shell command substitution syntax such as $(...) or backticks to execute commands not included in the ALLOWED_COMMANDS allowlist. This effectively bypasses the intended security validation check designed to restrict which commands can be executed. The flaw resides in the server.py source file of the cli-mcp-server package. It has been documented in a GitHub issue and reported via VulnCheck advisories. Exploitation could allow unauthorized command execution in environments relying on the allowlist as a security boundary. Users are advised to review configurations and apply available patches or mitigations.