LiteLLM - Command Injection

A critical unauthenticated remote code execution vulnerability exists in LiteLLM due to improper input handling in the MCP stdio test endpoint. An attacker can send a specially crafted request to the /mcp-rest/test/connection endpoint with controlled parameters, resulting in arbitrary command...

scopeblind-gateway

⚠️ 이 저장소는 이전되었습니다. 활성 개발은 ScopeBlind/scopeblind-gateway 에서 계속됩니다. 이 개인 포크는 공식 저장소보다 뒤쳐질 수 있습니다. 이슈, 풀 리퀘스트 및 최신 코드는 조직 저장소를 사용해 주세요. protect-mcp MCP 서버를 위한 보안 게이트웨이. 기본적으로 섀도우 모드 로그, 도구별 정책, 선택적 로컬 Ed25519 영수증, 검증 친화적인 감사 출력. 현재 CLI 경로: 모든 stdio MCP 서버를 투명 프록시로 래핑합니다. 섀도우 모드에서는 모든 tools/call 요청을...

local-mcp

local-mcp ローカルファイル操作用のゼロ依存MCPサーバー。 ファイルシステムツール13個＋段階的ディスカバリ用のメタツール3個 — SDK不要、フレームワーク不要、npm installも不要です。 MCPプロトコル: 2024-11-05 · トランスポート: stdio + Streamable HTTP · ランタイム: Node.js ≥ 22.0.0 アーキテクチャ root@kitploit: local-mcp.mjs — 595 lines, 13 tools, entry point lib/mcp-core.mjs — 229 lines, stdio +...

mcp-stdio-shellguard

StudioMeyer MCP Stack の一部 — マヨルカ島でビルド 🌴 · ⭐ お使いの際はスターを mcp-stdio-shellguard MCP stdio サーバー向けの多層防御バンドル。childprocess.exec/spawn を 許可リスト + サンドボックス + リプレイ検出でラップし、さらに MCP サーバーソースをスキャンして未サニタイズのシェル呼び出しを検出する AST 監査 CLI（mcp-shellguard-audit） を提供します。Ox-Security の MCP stdio-RCE...

mcpshield

mcpshield 未パッチのMCP STDIOコマンドインジェクション脆弱性（CVE-2026-30623ファミリー、2026年4月にOX Securityによって「仕様」として開示、SDKパッチはなし）に対するドロップイン修正です。1行インポートするだけで、Pythonアプリが起動するすべてのstdio MCPサーバーは、OSがプロセスを生成する前にコマンド/引数/環境変数が検証されます。 初めての方は、まずスコープを読み、次にインストールとはじめにを読めば、2分以内に保護されます。 目次 プロジェクトの状態 スコープ インストール はじめに オプションA: 自動パッチ（Python...

CVE-2026-12940-Langflow-Unauth-RCE

CVE-2026-12940 — Langflow OSS ≤ 1.10.1 の未認証RCE（MCP stdio 環境変数インジェクション） Langflow OSS 1.10.1 以前における未認証のリモートコード実行（RCE）。MCP stdio サーバー設定を保護する環境変数ブロックリスト（DANGEROUSENVVARS）には、SHELLOPTS、BASHOPTS、PS4 が含まれていません。MCP stdio ランチャーが設定されたコマンドを bash -c で実行するため、攻撃者は SHELLOPTS=xtrace と PS4 のコマンド置換を注入し、Langflow...

CVE-2025-6514

mcp-remote ローカル（stdio）サーバーのみをサポートするMCPクライアントを、認証サポート付きでリモートMCPサーバーに接続します： 注：これは動作する概念実証（proof-of-concept）です が、実験的 と見なすべきです。 なぜこれが必要なのか？...

CVE-2026-42271-PoC

CVE-2026-42271 — MCP stdioテストエンドポイントを介したLiteLLMの認証済みコマンドインジェクション LiteLLM の POST /mcp-rest/test/connection および POST /mcp-rest/test/tools/list — MCP stdioトランスポートを介した認証済みコマンドインジェクション。有効なAPIキーがあれば、任意のOSコマンドをroot として実行できます（デフォルトのDockerデプロイメントの場合）。 イメージはdigestで固定済み : vulnerableコンテナはLiteLLM v1.82.6...

EUVD-2026-83658

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpointorcommand causes command injection. The attack may be initiated remotely...

CVE-2026-93965: Improper Neutralization of Special Elements used in a Command

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpointorcommand causes command injection. The attack may be initiated remotely...

CVE-2026-90898

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.authconfig.isenabled=false. Auth off means every caller is a local admin...

CVE-2026-90898 Bifrost unauthenticated remote code execution via MCP stdio client registration

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.authconfig.isenabled=false. Auth off means every caller is a local admin...

CVE-2026-90898

Bifrost (by maximhq) is vulnerable to unauthenticated remote code execution through its MCP stdio client registration endpoint. When a stdio client is registered via POST /api/mcp/client, Bifrost immediately spawns the specified command in the gateway—no MCP handshake required. By default, authen...

CVE-2026-90898 Bifrost unauthenticated remote code execution via MCP stdio client registration

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.authconfig.isenabled=false. Auth off means every caller is a local admin...

CVE-2026-90898 Bifrost unauthenticated remote code execution via MCP stdio client registration

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.authconfig.isenabled=false. Auth off means every caller is a local admin...

CVE-2026-90898: Missing Authentication for Critical Function

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.authconfig.isenabled=false. Auth off means every caller is a local admin...

EUVD-2026-75780

IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess...

EUVD-2026-75796

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration...

Linux Distros Unpatched Vulnerability : CVE-2026-88265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's...

CVE-2026-81941

IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess...