CVE-2026-108953

mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into executecommand arguments. Attackers or malicious prompts can call a safe command such as pwd with arguments like ';' to run...