mcp-stdio-shellguard

StudioMeyer MCP Stack 的一部分 — 在马略卡岛构建 🌴 · 如果使用请⭐ mcp-stdio-shellguard 针对 MCP stdio 服务器的深度防御捆绑包。使用白名单 + 沙箱 + 重放检测包装 childprocess.exec/spawn，外加一个 AST 审计 CLI mcp-shellguard-audit，用于扫描 MCP 服务器源中未清理的 shell 调用。封堵了 Ox-Security MCP stdio-RCE 漏洞类别（200k 台易受攻击服务器，2026 年 5 月披露）。 MCP spec : 2025-06-18 SDK :...

scopeblind-gateway

⚠️ このリポジトリは移動しました。 アクティブな開発は ScopeBlind/scopeblind-gateway で継続しています。 この個人フォークは正規リポジトリより古い可能性があります。Issue、プルリクエスト、最新コードについては組織リポジトリをご使用ください。 protect-mcp MCPサーバー向けセキュリティゲートウェイ。デフォルトでシャドウモードのログ、ツールごとのポリシー、オプションのローカルEd25519レシート、検証しやすい監査出力。 現在のCLIパス: 任意のstdio MCPサーバーを透過プロキシとしてラップします。シャドウモードではすべての...

LiteLLM - Command Injection

A critical unauthenticated remote code execution vulnerability exists in LiteLLM due to improper input handling in the MCP stdio test endpoint. An attacker can send a specially crafted request to the /mcp-rest/test/connection endpoint with controlled parameters, resulting in arbitrary command...

CVE-2026-79538

metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio createTransport, STDIO branch, routers/mcp-proxy/server.ts...

mcpshield

mcpshield 一个针对未修补的 MCP STDIO 命令注入漏洞（CVE-2026-30623 系列，由 OX Security 于 2026 年 4 月披露，归为“设计问题”——无 SDK 补丁）的即插即用修复方案。只需导入一行代码，你的 Python 应用启动的每个 stdio MCP 服务器，在操作系统生成进程之前，其命令/参数/环境变量都会经过验证。 如果你是新手，请先阅读 适用范围，然后 安装 和 快速入门 将让你在两分钟内获得保护。 目录 项目状态 适用范围 安装 快速入门 选项 A：自动补丁（Python MCP 主机） 选项 B：静态检查（任何语言，零执行） 选项...

CVE-2026-12940-Langflow-Unauth-RCE

CVE-2026-12940 — Langflow OSS ≤ 1.10.1 未认证 RCE（MCP stdio 环境变量注入） 在 Langflow OSS 直至 1.10.1 的版本中存在未认证远程代码执行漏洞。用于保护 MCP stdio 服务器配置的环境变量黑名单（DANGEROUSENVVARS）遗漏了 SHELLOPTS、BASHOPTS 和 PS4。由于 MCP stdio 启动器会通过 bash -c 运行配置的命令，攻击者可以注入 SHELLOPTS=xtrace 以及 PS4 命令替换，并以 Langflow 进程用户的身份执行任意 shell 命令——无需有效的 M...

CVE-2025-6514

mcp-remote 将仅支持本地（stdio）服务器的 MCP 客户端连接到远程 MCP 服务器，并支持身份验证： 注意：这是一个可用的概念验证 ，但应被视为实验性 。 为什么需要它？ 到目前为止，大多数 MCP 服务器都通过 stdio 传输在本地安装。这样做有一些好处：客户端和服务器可以隐式信任彼此，因为用户已授予它们运行权限。添加 API 密钥等机密信息可以使用环境变量来完成，并且永远不会离开你的机器。此外，基于 npx 和 uvx 构建还可以让用户避免显式的安装步骤。...

CVE-2026-79538

metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio createTransport, STDIO branch, routers/mcp-proxy/server.ts...

CVE-2026-79538

metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio createTransport, STDIO branch, routers/mcp-proxy/server.ts...

CVE-2026-79538

The metatool-ai MetaMCP software, specifically version 2.4.22 and below, is vulnerable to Code Execution . This vulnerability exists in the internal MCP inspector proxy endpoint at GET /mcp-proxy/server/stdio. The root cause is located within the createTransport function in the STDIO branch , spe...

EUVD-2026-89360

metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio createTransport, STDIO branch, routers/mcp-proxy/server.ts...

CVE-2026-42271-PoC

CVE-2026-42271 — LiteLLM MCP stdio 测试端点认证命令注入漏洞 LiteLLM POST /mcp-rest/test/connection 和 POST /mcp-rest/test/tools/list — 通过 MCP stdio 传输实现的需认证命令注入。任何有效的 API 密钥都可以以 root 身份（默认 Docker 部署中）执行任意操作系统命令。 镜像已通过 digest 固定 ：存在漏洞的容器固定为 LiteLLM v1.82.6 ，确保长期可复现。 字段| 值 ---|--- CVE| CVE-2026-42271 CVSS v4.0|...

local-mcp

local-mcp 零依赖的 MCP 服务器，用于本地文件操作。 13 个文件系统工具 + 3 个元工具用于渐进式发现 — 无需 SDK、无需框架、无需 npm install。 MCP 协议: 2024-11-05 · 传输: stdio + Streamable HTTP · 运行时: Node.js ≥ 22.0.0 架构 local-mcp.mjs — 595 lines, 13 tools, entry point lib/mcp-core.mjs — 229 lines, stdio + HTTP transport, 9 MCP methods lib/config.mjs...

EUVD-2026-83658

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpointorcommand causes command injection. The attack may be initiated remotely...

PT-2026-95912

Name of the Vulnerable Software and Affected Versions aiyiyi121 SxDevOps versions 1.0 through 1.1 Description A command injection flaw exists in the MCP STDIO Server Management component within the subprocess.Popen function of the backend/aiops/services.py file. A remote attacker can exploit this...

CVE-2026-93965: Improper Neutralization of Special Elements used in a Command

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpointorcommand causes command injection. The attack may be initiated remotely...

CVE-2026-90898

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.authconfig.isenabled=false. Auth off means every caller is a local admin...

CVE-2026-90898 Bifrost unauthenticated remote code execution via MCP stdio client registration

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.authconfig.isenabled=false. Auth off means every caller is a local admin...

CVE-2026-90898

Bifrost (by maximhq) is vulnerable to unauthenticated remote code execution through its MCP stdio client registration endpoint. When a stdio client is registered via POST /api/mcp/client, Bifrost immediately spawns the specified command in the gateway—no MCP handshake required. By default, authen...

CVE-2026-90898 Bifrost unauthenticated remote code execution via MCP stdio client registration

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.authconfig.isenabled=false. Auth off means every caller is a local admin...