by Kastro
Paper/Archive/CVE-2026-85660

CVE-2026-85660

MladenSU cli-mcp-server — cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution

EPSS 0.6%public exploitCVSS 9.2
critical.is priorityof 100
48
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 49.8.498 × 2010.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with_operators function when ALLOW_SHELL_OPERATORS is enabled. Attackers can use shell command substitution syntax like $(...) or backticks to execute non-allowlisted commands that bypass the ALLOWED_COMMANDS validation check.

Affected

ProductAffectedFixed inSource
cli-mcp-server≤ 0.2.5–CNA

Scores by source

VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheck (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/MladenSU/cli-mcp-server/issues/17refgithub.com/MladenSU/cli-mcp-serverwriteupgithub.com/MladenSU/cli-mcp-server/blob/main/src/cli_mcp_server/server.pywriteupvulncheck.com/advisories/cli-mcp-server-0.2.5-command-allowlist-bypass-via-shell-substitution