Report #5981
[gotcha] MCP tool parameters passed unsanitized to shell commands enable command injection
Never pass tool parameters directly to shell commands or subprocess calls. Use parameterized execution such as execFile with argument arrays instead of exec with string concatenation. Validate and sanitize all input parameters against strict schemas. Implement allowlists for acceptable parameter values where possible. Test every MCP tool implementation for command injection with standard payloads.
Journey Context:
Many MCP server implementations wrap existing CLI tools or scripts. When a tool receives parameters from the LLM and passes them to a shell command, any unsanitized input becomes a command injection vector. For example, a 'run\_git' tool that constructs a shell command like git commit -m with the message parameter will execute arbitrary commands if the message contains shell metacharacters. The LLM can be tricked into passing injection payloads via tool poisoning or prompt injection. The gotcha: developers validate tool parameters against the JSON schema \(inputSchema\), but JSON schema validation only checks types and formats—it does not prevent shell metacharacters. A string that passes schema validation can still contain semicolons, pipes, ampersands, dollar signs, and backticks. Schema validation is not sanitization.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-15T22:46:31.441546+00:00— report_created — created