Summary
esp-mcp contains an OS command injection vulnerability in MCP tool handling. If an attacker can influence tool-call parameters through prompt injection or another untrusted input path, shell metacharacters may be interpreted and arbitrary commands could run with the privileges of the MCP server.
esp-mcp contains an OS command injection vulnerability in MCP tool handling. If an attacker can influence tool-call parameters through prompt injection or another untrusted input path, shell metacharacters may be interpreted and arbitrary commands could run with the privileges of the MCP server.
Affected context
The vulnerability occurs in esp-mcp deployments where MCP tool parameters such as target, port, project_path, or project_name can be influenced by untrusted content and are passed to asyncio.create_subprocess_shell. Risk is higher when an agent accepts external prompts, retrieves untrusted data, or otherwise allows model-generated tool arguments to reach shell-backed operations without strict validation.
The vulnerability occurs in esp-mcp deployments where MCP tool parameters such as target, port, project_path, or project_name can be influenced by untrusted content and are passed to asyncio.create_subprocess_shell. Risk is higher when an agent accepts external prompts, retrieves untrusted data, or otherwise allows model-generated tool arguments to reach shell-backed operations without strict validation.
Exploit preconditions
- Attack surface: MCP tool handlers that invoke shell commands
- Required access: Ability to influence an agent prompt, retrieved content, or other input that affects MCP tool parameters
- Trigger point: Construction and execution of a shell command using attacker-influenced parameter values
- Why exploitation is possible: Shell interpretation treats metacharacters in untrusted values as command syntax rather than ordinary data
- Execution context: Commands run with the permissions and environment available to the MCP server process
- Attack surface: MCP tool handlers that invoke shell commands
- Required access: Ability to influence an agent prompt, retrieved content, or other input that affects MCP tool parameters
- Trigger point: Construction and execution of a shell command using attacker-influenced parameter values
- Why exploitation is possible: Shell interpretation treats metacharacters in untrusted values as command syntax rather than ordinary data
- Execution context: Commands run with the permissions and environment available to the MCP server process
Why this happens
The underlying issue is the use of a shell-executing subprocess interface with values that are not sufficiently constrained before command construction. asyncio.create_subprocess_shell invokes a command through a shell, causing metacharacters embedded in attacker-influenced parameters to receive special interpretation. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly called OS command injection.
The underlying issue is the use of a shell-executing subprocess interface with values that are not sufficiently constrained before command construction. asyncio.create_subprocess_shell invokes a command through a shell, causing metacharacters embedded in attacker-influenced parameters to receive special interpretation. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly called OS command injection.
Potential impact
- An attacker may execute arbitrary operating-system commands
- The MCP server environment could be compromised
- Sensitive files, credentials, or environment variables may be accessed
- The attacker could alter projects, build outputs, or related data
- Further compromise could occur if the server has excessive privileges or network access
- An attacker may execute arbitrary operating-system commands
- The MCP server environment could be compromised
- Sensitive files, credentials, or environment variables may be accessed
- The attacker could alter projects, build outputs, or related data
- Further compromise could occur if the server has excessive privileges or network access
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from application-controlled operations and reducing trust in agent-generated parameters.
Common defensive patterns include:
- Prefer direct subprocess execution with an argument list rather than shell-based execution
- Apply strict allowlists, type checks, and canonicalization to tool parameters
- Keep agent-generated values separate from command structure and executable selection
- Reject unexpected characters, paths, ports, and target formats according to the tool's intended grammar
- Run the MCP server with a dedicated, least-privileged identity and restricted filesystem and network access
- Treat prompts, retrieved content, and model-generated tool arguments as untrusted input
- Add authorization and human or policy approval gates for sensitive operations
Mitigation generally focuses on removing shell interpretation from application-controlled operations and reducing trust in agent-generated parameters.
Common defensive patterns include:
- Prefer direct subprocess execution with an argument list rather than shell-based execution
- Apply strict allowlists, type checks, and canonicalization to tool parameters
- Keep agent-generated values separate from command structure and executable selection
- Reject unexpected characters, paths, ports, and target formats according to the tool's intended grammar
- Run the MCP server with a dedicated, least-privileged identity and restricted filesystem and network access
- Treat prompts, retrieved content, and model-generated tool arguments as untrusted input
- Add authorization and human or policy approval gates for sensitive operations
How teams detect issues like this
Detection can include static analysis for create_subprocess_shell, shell invocation APIs, string interpolation, concatenation, or formatting used to build commands from tool parameters. Code review should examine every MCP tool boundary, especially values originating from prompts, retrieved documents, environment data, or model output. Runtime monitoring can alert on unusual child processes, shell creation, command arguments, and access to sensitive files. CI policies may block shell-based subprocess usage unless an approved, reviewed exception exists; automated code-review tools can help identify these patterns.
Detection can include static analysis for create_subprocess_shell, shell invocation APIs, string interpolation, concatenation, or formatting used to build commands from tool parameters. Code review should examine every MCP tool boundary, especially values originating from prompts, retrieved documents, environment data, or model output. Runtime monitoring can alert on unusual child processes, shell creation, command arguments, and access to sensitive files. CI policies may block shell-based subprocess usage unless an approved, reviewed exception exists; automated code-review tools can help identify these patterns.
