CyberRota Analysis
AI-GeneratedA command allowlist bypass vulnerability exists in cli-mcp-server version 0.2.5, specifically in the _validate_command_with_operators function when the ALLOW_SHELL_OPERATORS feature is enabled. This flaw allows attackers to execute unauthorized commands using shell command substitution syntax, undermining the intended security controls. Organizations utilizing this version of cli-mcp-server should prioritize remediation to prevent potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with_operators function when ALLOW_SHELL_OPERATORS is enabled. Attackers can use shell command substitution syntax like $(...) or backticks to execute non-allowlisted commands that bypass the ALLOWED_COMMANDS validation check.