mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default security.yaml allows /usr/bin/git, while security.go omits ! from containsShellMetacharacters and containsDangerousShellConstructs and applies no per-executable argument policy. A caller of the shell_exec MCP tool can provide the command argument /usr/bin/git -c alias.pwn=!<arbitrary-command>, causing Git to create a shell alias and execute arbitrary OS commands as the mcp-shell process user. The default Docker image runs as mcpuser with Git installed and secure mode enabled, so the bypass is exploitable in the default deployment without additional authentication beyond MCP connectivity. This issue is fixed in version 0.6.0.

CVE-2026-55582 affects mcp-shell, an MCP server for running shell commands securely. Prior to version 0.6.0, the default security.yaml configuration permits /usr/bin/git, while the security.go file fails to include the '!' character in its shell metacharacter and dangerous construct checks. This oversight, combined with no per-executable argument policy, allows an attacker to pass a crafted Git -c alias argument to execute arbitrary OS commands. The exploit leverages Git's alias feature with shell escape syntax (!<command>) to bypass security controls. The default Docker deployment runs as mcpuser with Git installed and secure mode enabled, making it exploitable without additional authentication beyond MCP connectivity. The vulnerability is exploitable in default configurations, raising its risk profile significantly. The issue has been patched in version 0.6.0 of mcp-shell. Users are advised to upgrade immediately to mitigate the risk of arbitrary command execution.