Command whitelist in mac-shell-mcp bypassed with a semicolon

A flaw in mac-shell-mcp, an open-source Model Context Protocol server published by the developer cfdude, lets AI agent clients run commands the tool was supposed to forbid. The issue was published as CVE-2026-108953 by the US National Vulnerability Database on 12 October 2026 and affects all versions before 2.0.0.

MCP servers are small programs that give AI assistants access to tools and data on a machine. mac-shell-mcp gives an assistant the ability to run shell commands on macOS. Because that is obviously risky, the project uses a whitelist: a list of commands considered safe enough to run without a human approving them first, with everything else requiring approval.

According to the NVD entry, that whitelist can be bypassed. The server checks the command name but not what is passed to it as arguments. A client can therefore call a harmless whitelisted command such as pwd, which simply prints the current directory, and pass an argument containing a shell metacharacter such as a semicolon. The shell treats the semicolon as the end of one command and the start of another, so whatever follows runs too. The NVD describes the result as the ability to run forbidden commands as the server user without approval.

The advisory is explicit that this is not only an attack by a human operator. It says attackers "or malicious prompts" can trigger the behaviour. That matters for agent deployments, because the client calling the tool is usually a language model acting on text it has been given. If that text has been tampered with, for example a web page or document the agent reads, the model can be steered into making the tool call itself. The approval step that would normally put a person in the loop is simply skipped, because from the server's point of view the request looks like an ordinary call to a safe command.

The NVD record points to the relevant section of the project's command service source code, to a GitHub issue filed against the project, and to a commit in the repository. A separate advisory on the vulnerability has been published by VulnCheck. The fix is version 2.0.0, with the CVE description indicating that earlier releases are affected.

Command injection of this kind is a long-standing software weakness, but the whitelist design makes it particularly awkward here. The whitelist is the security control users are told to rely on, so a bypass removes the main reason to trust the server with unattended execution. Anyone running mac-shell-mcp should treat the pre-2.0.0 approval prompts as advisory rather than enforced.

The listed sources do not report any exploitation in the wild, and do not say how many installations are affected. The incident record compiled from the advisory gives the status as reported and the discovery date as 12 October 2026, with no date given for any real-world abuse. Users of the project should check which version they have installed and upgrade to 2.0.0 or later.