Report #84678
[gotcha] Shell command injection when LLM passes unsanitized arguments to OS-level MCP tools
Never use \`shell=True\` or string concatenation for OS commands in tool implementations. Use array-based execution \(e.g., \`execvp\`\) and strict input validation schemas.
Journey Context:
Developers build MCP tools that wrap bash scripts or CLI commands. The LLM generates arguments based on user input. If the tool implementation concatenates these arguments into a shell string, an attacker can use prompt injection to make the LLM pass malicious shell payloads \(e.g., \`; rm -rf /\`\).
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-22T00:43:09.624637+00:00— report_created — created