Report #11529
[gotcha] Command injection through unsanitized MCP tool arguments
Never concatenate LLM-provided arguments into shell commands. Use structured APIs, parameterized queries, or execve-style argument arrays instead of shell execution \(\`/bin/sh -c\`\).
Journey Context:
Tools that interface with the underlying OS often take a string parameter and run it via a shell. If the LLM is tricked via indirect prompt injection into providing an argument like \`foo; rm -rf /\`, the shell will execute both commands. Developers assume the LLM will only provide sensible arguments, but the LLM doesn't understand shell metacharacters the way a human does. It will happily pass malicious payloads if the prompt context instructs it to.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T13:38:37.767660+00:00— report_created — created