Summary
A critical code execution vulnerability in MetaMCP's internal MCP inspector proxy endpoint may allow attacker-controlled input to influence how an MCP server transport is created.
When the affected endpoint is reachable and the relevant request reaches the vulnerable STDIO handling path, an attacker could execute code with the privileges of the MetaMCP process.
Affected context
The issue affects MetaMCP deployments using versions up to and including 2.4.22 where the internal MCP inspector proxy endpoint is exposed or otherwise reachable. The relevant code is the GET /mcp-proxy/server/stdio route, specifically the createTransport STDIO branch in routers/mcp-proxy/server.ts; exploitability depends on network exposure, authentication controls, and how endpoint parameters are handled.
Exploit preconditions
- Attack surface: The MCP inspector proxy HTTP endpoint at
/mcp-proxy/server/stdio - Required access: Network reachability and any authentication or authorization access enforced by the deployment
- Trigger point: A request processed by the endpoint's
createTransportSTDIO branch - Why exploitation is possible: Attacker-controlled request data may reach code-generation or command-construction behavior without sufficient separation between data and executable instructions
Why this happens
The vulnerability is an instance of CWE-94: Improper Control of Generation of Code. The affected proxy logic may construct or invoke a server transport using values influenced by an HTTP request without adequately constraining them to inert, validated data. When input is incorporated into executable expressions, commands, or runtime configuration, specially crafted values can alter program behavior and cause code execution.
Potential impact
- An attacker may execute arbitrary code with the privileges of the MetaMCP process
- The application could be compromised or used to access connected MCP services
- Sensitive environment variables, configuration, or credentials could be exposed
- An attacker could modify application data or disrupt MCP operations
- The host or surrounding infrastructure could be used for lateral movement, depending on isolation
General mitigation guidance
Mitigation generally focuses on keeping request data separate from executable logic and reducing exposure of internal proxy functionality.
Common defensive patterns include:
- Replacing dynamic command or code construction with fixed, allowlisted transport mappings
- Applying strict type, format, length, and character validation before transport creation
- Avoiding shell interpretation and runtime evaluation of request-derived values
- Requiring authentication and authorization for inspector and proxy endpoints
- Binding internal diagnostic interfaces to restricted networks rather than public interfaces
- Running the service with least privilege and isolating connected MCP processes
- Limiting filesystem, process, network, and credential access available to the application
- Treating all HTTP-derived values as untrusted, including values from authenticated clients
How teams detect issues like this
High-level detection can combine:
- Static analysis for dynamic evaluation, shell invocation, string-based command construction, and unsafe process-spawn patterns using request data
- Code review of the
createTransportSTDIO path and all values accepted by the MCP proxy route - API inventory checks to identify inspector or proxy endpoints exposed beyond trusted administrative networks
- Runtime monitoring for unexpected child-process creation, unusual command arguments, and anomalous access to secrets or external services
- Policy enforcement requiring allowlisted transport configurations, authentication, and authorization for internal tooling endpoints
- Automated security review tools that flag tainted data flows from HTTP parameters into execution APIs
