CVE-2026-55157

The token-optimizer-mcp software is vulnerable to OS command injection in the smart_user tool (specifically the get-user-info operation) prior to version 5.1.0 . The root cause is the unsafe interpolation of a user-controlled username argument into a shell command executed via execAsync(). Becaus...