Summary
The ai-sdlc MCP server through version 0.31.2 contains an OS command injection flaw in handling the repository argument. An attacker who can influence that argument, including through a prompt-injected agent, may cause arbitrary commands to run with the privileges of the MCP server user.
The ai-sdlc MCP server through version 0.31.2 contains an OS command injection flaw in handling the repository argument. An attacker who can influence that argument, including through a prompt-injected agent, may cause arbitrary commands to run with the privileges of the MCP server user.
Affected context
The vulnerability occurs when the MCP server processes repository-related requests and constructs gh issue view or gh pr view commands. Risk increases when repository arguments can be influenced by untrusted users, external content, or prompt-injected agents and are passed to a shell without validation or safe argument handling.
The vulnerability occurs when the MCP server processes repository-related requests and constructs gh issue view or gh pr view commands. Risk increases when repository arguments can be influenced by untrusted users, external content, or prompt-injected agents and are passed to a shell without validation or safe argument handling.
Exploit preconditions
- Attack surface: MCP server tools that retrieve GitHub issue or pull request information
- Required access: Ability to submit or influence the repository argument, directly or through an agent
- Trigger point: Execution of the constructed
gh issue vieworgh pr viewcommand - Why exploitation is possible: The repository value is interpolated into a shell command and executed through
execSync()without adequate validation or shell-safe argument handling
- Attack surface: MCP server tools that retrieve GitHub issue or pull request information
- Required access: Ability to submit or influence the repository argument, directly or through an agent
- Trigger point: Execution of the constructed
gh issue vieworgh pr viewcommand - Why exploitation is possible: The repository value is interpolated into a shell command and executed through
execSync()without adequate validation or shell-safe argument handling
Why this happens
The underlying bug is OS command injection caused by combining untrusted input with a shell command. Shell metacharacters in the repository argument may alter command interpretation when the value is interpolated into a string passed to execSync(). This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, because input is not reliably separated from command syntax before execution.
The underlying bug is OS command injection caused by combining untrusted input with a shell command. Shell metacharacters in the repository argument may alter command interpretation when the value is interpolated into a string passed to execSync(). This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, because input is not reliably separated from command syntax before execution.
Potential impact
- An attacker may execute arbitrary operating-system commands
- Commands could run with the privileges of the MCP server user
- Repository credentials, environment variables, or local files could be exposed
- The MCP server runtime could be modified or disrupted
- The compromised process could be used for lateral movement, depending on available permissions
- An attacker may execute arbitrary operating-system commands
- Commands could run with the privileges of the MCP server user
- Repository credentials, environment variables, or local files could be exposed
- The MCP server runtime could be modified or disrupted
- The compromised process could be used for lateral movement, depending on available permissions
General mitigation guidance
Mitigation generally focuses on preventing untrusted values from being interpreted as shell syntax.
Common defensive patterns include:
- Avoiding shell invocation when a direct process API can be used
- Passing command arguments as structured arrays rather than interpolated command strings
- Applying strict allowlists for repository, owner, issue, and pull request identifiers
- Rejecting unexpected characters and enforcing expected input formats before command execution
- Separating agent-generated content from trusted operational parameters
- Running the MCP server with least-privilege accounts and minimal filesystem and network permissions
- Limiting access to GitHub tokens and other process environment secrets
Mitigation generally focuses on preventing untrusted values from being interpreted as shell syntax.
Common defensive patterns include:
- Avoiding shell invocation when a direct process API can be used
- Passing command arguments as structured arrays rather than interpolated command strings
- Applying strict allowlists for repository, owner, issue, and pull request identifiers
- Rejecting unexpected characters and enforcing expected input formats before command execution
- Separating agent-generated content from trusted operational parameters
- Running the MCP server with least-privilege accounts and minimal filesystem and network permissions
- Limiting access to GitHub tokens and other process environment secrets
How teams detect issues like this
Organizations can identify this weakness through:
- Static analysis rules for
execSync(), shell execution APIs, and string interpolation involving external input - Code review checks for command construction using template literals or concatenation
- Tests that submit metacharacters and unexpected delimiters to command-related tool arguments
- Runtime monitoring for unusual child processes, command arguments, and outbound activity from the MCP server
- Policy enforcement requiring structured process APIs and approved input validation utilities
Automated security review tools may help flag shell execution paths, but findings should be validated against the actual trust boundary and execution environment.
Organizations can identify this weakness through:
- Static analysis rules for
execSync(), shell execution APIs, and string interpolation involving external input - Code review checks for command construction using template literals or concatenation
- Tests that submit metacharacters and unexpected delimiters to command-related tool arguments
- Runtime monitoring for unusual child processes, command arguments, and outbound activity from the MCP server
- Policy enforcement requiring structured process APIs and approved input validation utilities
Automated security review tools may help flag shell execution paths, but findings should be validated against the actual trust boundary and execution environment.
