CVE-2025-61489

A command injection vulnerability in the shell_exec function of sonirico mcp-shell v0.3.1 allows attackers to execute arbitrary commands via supplying a crafted command string.

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - cve@mitre.org

Published

2026-01-07

Last modified

2026-01-07

Weaknesses

CWE-77

Affected products

• Mcp-shell (Sonirico)

References

• https://github.com/sonirico/mcp-shell
• https://github.com/sonirico/mcp-shell/issues/4