Summary
A critical OS command injection vulnerability in the wiki_capture_source MCP tool of pi-llm-wiki allows commands to be injected through manipulation of the URL argument.
Because the affected functionality can be reached remotely, an attacker may execute operating-system commands in the service's execution environment when crafted URL data is processed unsafely.
Affected context
The vulnerability occurs in the wiki_capture_source MCP tool, associated with mcp/index.ts, when it processes a user-controlled url argument. Deployments are at risk when remote requests can reach this tool and URL data is incorporated into a shell command or command-like operation without adequate separation and validation.
Exploit preconditions
- Attack surface: Remotely accessible MCP tool functionality
- Required access: Ability to invoke the
wiki_capture_sourcetool or otherwise submit its URL argument - Trigger point: Processing of the manipulated
urlvalue - Why exploitation is possible: Untrusted URL input can influence operating-system command construction or execution without sufficient command-context isolation
Why this happens
The underlying flaw is an OS command injection condition. Application data supplied through the URL argument is treated as part of an operating-system command rather than as strictly bounded data.
This maps primarily to CWE-78: Improper Neutralization of Special Elements used in an OS Command. CWE-77: Improper Neutralization of Special Elements in Command is also relevant because the vulnerable behavior involves insufficient separation between externally controlled input and command syntax.
Potential impact
- An attacker may execute arbitrary operating-system commands
- The service process and its accessible files or credentials could be compromised
- Sensitive data may be read, altered, or removed
- The affected host or container could be used for lateral movement
- Availability of the wiki or connected services could be disrupted
General mitigation guidance
Mitigation generally focuses on preventing user-controlled data from becoming command syntax.
Common defensive patterns include:
- Prefer direct library or API calls over shell invocation
- If process execution is unavoidable, use argument-array interfaces that do not invoke a shell
- Apply strict allowlist validation to URLs, schemes, hosts, and permitted paths
- Treat all tool arguments as untrusted, including values originating from authenticated users
- Run the service with least privilege and isolate it from sensitive files, credentials, and administrative interfaces
- Apply network egress restrictions and sandboxing appropriate to the deployment
- Preserve safe-by-default behavior when validation fails
How teams detect issues like this
Detection can combine static analysis, review, and runtime controls:
- Search for shell execution APIs, child-process creation, command concatenation, and template-based command construction near MCP tool handlers
- Review whether URL-derived values reach interpreters, shells, subprocesses, or system utilities
- Flag string interpolation or concatenation involving request parameters in process-execution code
- Add policy checks that require approved process-execution wrappers and argument-array interfaces
- Monitor process creation from the service for unexpected binaries, arguments, or child-process chains
- Use automated code-review and application-security tools to identify command-injection data flows
