EUVD-2026-88397

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

CVE-2026-55157: Improper Neutralization of Special Elements used in an OS Command

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Summary token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. The get-user-info operation accepts a user-controlled username argument and later interpolates it into a shell command executed through execAsync: ts getent passwd "$username" || grep "^$username:" /etc/passw...

GHSA-49MQ-FC6Q-3H46 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Summary token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. The get-user-info operation accepts a user-controlled username argument and later interpolates it into a shell command executed through execAsync: ts getent passwd "$username" || grep "^$username:" /etc/passw...