CVE-2026-85660

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the validatecommandwithoperators function when ALLOWSHELLOPERATORS is enabled. Attackers can use shell command substitution syntax like $... or backticks to execute non-allowlisted commands that bypass the ALLOWEDCOMMANDS...

CVE-2026-85660 cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the validatecommandwithoperators function when ALLOWSHELLOPERATORS is enabled. Attackers can use shell command substitution syntax like $... or backticks to execute non-allowlisted commands that bypass the ALLOWEDCOMMANDS...

EUVD-2026-71116

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the validatecommandwithoperators function when ALLOWSHELLOPERATORS is enabled. Attackers can use shell command substitution syntax like $... or backticks to execute non-allowlisted commands that bypass the ALLOWEDCOMMANDS...

CVE-2026-85660

cli-mcp-server 0.2.5 contains a command allowlist bypass in the _validate_command_with_operators function. When ALLOW_SHELL_OPERATORS is enabled, an attacker can inject shell command substitution syntax such as $(...) or backticks to execute commands that are not on the ALLOWED_COMMANDS allowlist...

CVE-2026-85660 cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the validatecommandwithoperators function when ALLOWSHELLOPERATORS is enabled. Attackers can use shell command substitution syntax like $... or backticks to execute non-allowlisted commands that bypass the ALLOWEDCOMMANDS...