CVE-2026-85660

cli-mcp-server 0.2.5, a Model Context Protocol (MCP) server that exposes a whitelist of CLI commands to connected clients or AI agents, fails to validate commands embedded in shell substitution syntax when the ALLOW_SHELL_OPERATORS option is enabled. An attacker (typically via an untrusted prompt or input relayed through a connected agent) can craft command strings containing $(...) or backtick substitution: the ALLOWED_COMMANDS check in _validate_command_with_operators sees only the allowlisted command, but the substituted commands execute through the shell anyway. The result is execution of arbitrary non-allowlisted commands with the privileges of the process running the MCP server, which undermines the entire allowlist control. Only deployments running cli-mcp-server 0.2.5 with ALLOW_SHELL_OPERATORS enabled and relying on ALLOWED_COMMANDS restrictions are affected. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.5%, while the CVSS 4.0 vector (AC:H, AT:P) indicates exploitation requires specific conditions despite the 9.2 (critical) severity.

What to do: Move off version 0.2.5 to a patched release of cli-mcp-server when one becomes available (no fixed version is specified in the available data) and check the project's advisories for the fix. As interim mitigations, disable ALLOW_SHELL_OPERATORS or treat the allowlist as advisory-only, restrict which clients/agents can invoke commands, and review execution logs for $(...) or backtick usage inside allowlisted commands.