Summary
Token Optimizer MCP contains an OS command injection vulnerability in the smart_user tool's get-user-info operation. An MCP client that can invoke this tool may execute arbitrary shell commands by supplying a crafted username argument, with the privileges of the server process.
Affected context
The vulnerability occurs in Token Optimizer MCP deployments that expose the smart_user tool and process the username argument for the get-user-info operation without adequately separating user-controlled data from shell commands. Any MCP client permitted to call the affected tool may reach the vulnerable code path, and the resulting commands run under the operating-system account hosting the server.
Exploit preconditions
- Attack surface: The MCP
smart_usertool and itsget-user-infooperation - Required access: Permission for an MCP client to invoke the affected tool
- Trigger point: Processing the attacker-controlled
usernameargument - Why exploitation is possible: The argument reaches an operating-system command execution context without sufficient command separation or neutralization
Why this happens
The underlying flaw is the use of untrusted input in an operating-system command context. When application data is incorporated into a shell command without strict separation, validation, or safe process APIs, command syntax supplied by the input can alter the intended operation and cause additional commands to execute. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection).
Potential impact
- Arbitrary shell commands may execute on the server
- The attacker could access, alter, or delete data available to the server account
- Credentials, tokens, or configuration information may be exposed
- The MCP service could be disrupted or used for persistence
- Additional systems may be affected if the server account has excessive privileges
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from application-controlled operations and reducing the trust placed in tool arguments.
Common defensive patterns include:
- Prefer direct process APIs with argument arrays rather than shell invocation
- Replace command execution with a fixed internal function or allowlisted operation
- Apply strict type, length, and character validation to usernames
- Avoid using user-controlled values in command strings, including through indirect wrappers
- Restrict which MCP clients and tools can access the affected operation
- Run the server with a dedicated least-privileged account and isolate its filesystem and network access
- Protect secrets from the server process and apply restrictive execution policies
How teams detect issues like this
Detection approaches may include:
- Static analysis rules for shell execution APIs, command-string construction, and interpolation of request parameters
- Code review checks for MCP tool arguments flowing into subprocess, shell, or system execution functions
- Runtime monitoring for unexpected child processes, shell interpreters, or unusual command arguments spawned by the server
- Policy enforcement that restricts shell execution and requires allowlisted tool operations
- Automated security review tools that trace untrusted tool input into command execution sinks
