cleveragents/cleveragents-core

Fork 3

BUG-HUNT: [MCP-SECURITY] Command injection vulnerability in MCPServerConfig validation #7038

New issue

Open

opened 2026-04-10 07:21:56 +00:00 by HAL9000 · 2 comments

HAL9000 commented

2026-04-10 07:21:56 +00:00

Owner

Metadata

Branch: bugfix/m3.2.0-mcp-command-injection-validation
Commit Message: fix(mcp): add command injection protection to MCPServerConfig validation
Milestone: v3.2.0
Parent Epic: Orphan — see note below; requires manual Epic linking

Bug Report: [SECURITY] — Command injection vulnerability in MCPServerConfig validation

Severity Assessment

Impact: Arbitrary command execution on host system, potential full system compromise
Likelihood: High when processing untrusted MCP server configurations
Priority: Critical

Location

File: src/cleveragents/mcp/adapter.py
Function/Class: MCPToolAdapter._validate_config()
Lines: 200-217

Description

The MCPServerConfig validation for stdio transport only checks that the command field is non-empty but performs no sanitization or validation of the command content. This allows arbitrary command injection when untrusted MCP server configurations are processed.

Evidence

# In src/cleveragents/mcp/adapter.py lines 206-210:
if config.transport == "stdio" and not config.command:
    msg = (
        f"MCPServerConfig '{config.name}': stdio transport "
        f"requires 'command' field"
    )
    raise ValueError(msg)

A malicious configuration could inject shell commands:

MCPServerConfig(
    name="malicious",
    transport="stdio",
    command="legitimate-server; rm -rf /tmp; evil-payload"
)

Expected Behavior

MCPServerConfig validation should sanitize and validate command paths
Commands should be restricted to safe executable paths
Shell injection should be prevented through proper input validation
Environment variables should be validated for safety

Actual Behavior

Any string command is accepted without validation
Shell metacharacters are not filtered or escaped
No path traversal protection for command execution
Environment variables can be arbitrarily injected via env dict

Suggested Fix

Validate command is a safe executable path (no shell metacharacters)
Restrict commands to allowlisted directories
Sanitize environment variables
Add input validation for URL fields in SSE/HTTP transports
Consider using subprocess with shell=False for execution

TDD Note

After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. The test will use tags: @tdd_issue, @tdd_issue_<this-issue-number>, and @tdd_expected_fail to prove the bug exists before fixing it.

Subtasks

Write TDD test (@tdd_issue, @tdd_issue_<N>, @tdd_expected_fail) proving command injection is possible via MCPServerConfig.command
Implement shell metacharacter validation in MCPToolAdapter._validate_config() for stdio transport
Implement path safety validation (no traversal, restricted to safe executables)
Sanitize and validate env dict values in MCPServerConfig
Add URL validation for SSE/HTTP transport url fields
Remove @tdd_expected_fail tag once fix is confirmed passing
Update documentation for MCPServerConfig security constraints
Ensure all nox stages pass

Definition of Done

TDD test exists with @tdd_issue and @tdd_issue_<N> tags (permanent) and @tdd_expected_fail removed after fix
MCPToolAdapter._validate_config() rejects commands containing shell metacharacters (;, |, &, `, $(), >, <, \n, etc.)
Path traversal sequences (../, ./) rejected in command field
Environment variable values validated for injection risk
URL fields validated for SSE/HTTP transports
No regression in existing MCP adapter tests
All nox stages pass
Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: new-issue-creator

## Metadata - **Branch**: `bugfix/m3.2.0-mcp-command-injection-validation` - **Commit Message**: `fix(mcp): add command injection protection to MCPServerConfig validation` - **Milestone**: v3.2.0 - **Parent Epic**: _Orphan — see note below; requires manual Epic linking_ ## Bug Report: [SECURITY] — Command injection vulnerability in MCPServerConfig validation ### Severity Assessment - **Impact**: Arbitrary command execution on host system, potential full system compromise - **Likelihood**: High when processing untrusted MCP server configurations - **Priority**: Critical ### Location - **File**: `src/cleveragents/mcp/adapter.py` - **Function/Class**: `MCPToolAdapter._validate_config()` - **Lines**: 200-217 ### Description The MCPServerConfig validation for stdio transport only checks that the `command` field is non-empty but performs no sanitization or validation of the command content. This allows arbitrary command injection when untrusted MCP server configurations are processed. ### Evidence ```python # In src/cleveragents/mcp/adapter.py lines 206-210: if config.transport == "stdio" and not config.command: msg = ( f"MCPServerConfig '{config.name}': stdio transport " f"requires 'command' field" ) raise ValueError(msg) ``` A malicious configuration could inject shell commands: ```python MCPServerConfig( name="malicious", transport="stdio", command="legitimate-server; rm -rf /tmp; evil-payload" ) ``` ### Expected Behavior - MCPServerConfig validation should sanitize and validate command paths - Commands should be restricted to safe executable paths - Shell injection should be prevented through proper input validation - Environment variables should be validated for safety ### Actual Behavior - Any string command is accepted without validation - Shell metacharacters are not filtered or escaped - No path traversal protection for command execution - Environment variables can be arbitrarily injected via env dict ### Suggested Fix 1. Validate command is a safe executable path (no shell metacharacters) 2. Restrict commands to allowlisted directories 3. Sanitize environment variables 4. Add input validation for URL fields in SSE/HTTP transports 5. Consider using subprocess with shell=False for execution ### Category security ### TDD Note After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. The test will use tags: `@tdd_issue`, `@tdd_issue_<this-issue-number>`, and `@tdd_expected_fail` to prove the bug exists before fixing it. ## Subtasks - [ ] Write TDD test (`@tdd_issue`, `@tdd_issue_<N>`, `@tdd_expected_fail`) proving command injection is possible via `MCPServerConfig.command` - [ ] Implement shell metacharacter validation in `MCPToolAdapter._validate_config()` for stdio transport - [ ] Implement path safety validation (no traversal, restricted to safe executables) - [ ] Sanitize and validate `env` dict values in `MCPServerConfig` - [ ] Add URL validation for SSE/HTTP transport `url` fields - [ ] Remove `@tdd_expected_fail` tag once fix is confirmed passing - [ ] Update documentation for `MCPServerConfig` security constraints - [ ] Ensure all nox stages pass ## Definition of Done - [ ] TDD test exists with `@tdd_issue` and `@tdd_issue_<N>` tags (permanent) and `@tdd_expected_fail` removed after fix - [ ] `MCPToolAdapter._validate_config()` rejects commands containing shell metacharacters (`;`, `|`, `&`, `` ` ``, `$()`, `>`, `<`, `\n`, etc.) - [ ] Path traversal sequences (`../`, `./`) rejected in command field - [ ] Environment variable values validated for injection risk - [ ] URL fields validated for SSE/HTTP transports - [ ] No regression in existing MCP adapter tests - [ ] All nox stages pass - [ ] Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: new-issue-creator

HAL9000 added this to the v3.2.0 milestone

2026-04-10 07:22:01 +00:00

HAL9000 added the

State

Unverified

label

2026-04-10 07:23:13 +00:00

HAL9000 commented

2026-04-10 07:23:43 +00:00

Author

Owner

⚠️ Orphan Issue — Manual Epic Linking Required

This issue was created by the automated bug-hunting pipeline and no parent Epic covering MCP security / MCPToolAdapter input validation could be found in the open issue tracker.

Per CONTRIBUTING.md, every Issue must belong to at least one Epic (no orphan issues). A maintainer should:

Identify or create an appropriate parent Epic (e.g., an "MCP Adapter Security Hardening" Epic or a broader "Security Hardening" Epic).

Link this issue as a child using Forgejo's dependency system:

This issue blocks the parent Epic (child blocks parent — correct direction).

curl -s -X POST "https://git.cleverthis.com/api/v1/repos/cleveragents/cleveragents-core/issues/7038/blocks" \
  -H "Authorization: token <PAT>" \
  -H "Content-Type: application/json" \
  -d '{"owner": "cleveragents", "repo": "cleveragents-core", "index": <PARENT_EPIC_NUMBER>}'

Related existing MCP/security issues for context:

#6755 — MCPToolAdapter.connect() deadlock (concurrency)
#6969 — MCPToolAdapter never reaches a real MCP server
#6677 — InlineToolExecutor subprocess env variable exfiltration (security/Critical)
#6587 — TransformExecutor sandbox escape (security/Critical)

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: new-issue-creator

⚠️ **Orphan Issue — Manual Epic Linking Required** This issue was created by the automated bug-hunting pipeline and no parent Epic covering MCP security / `MCPToolAdapter` input validation could be found in the open issue tracker. Per CONTRIBUTING.md, every Issue **must** belong to at least one Epic (no orphan issues). A maintainer should: 1. Identify or create an appropriate parent Epic (e.g., an "MCP Adapter Security Hardening" Epic or a broader "Security Hardening" Epic). 2. Link this issue as a child using Forgejo's dependency system: - This issue **blocks** the parent Epic (child blocks parent — correct direction). ```bash curl -s -X POST "https://git.cleverthis.com/api/v1/repos/cleveragents/cleveragents-core/issues/7038/blocks" \ -H "Authorization: token <PAT>" \ -H "Content-Type: application/json" \ -d '{"owner": "cleveragents", "repo": "cleveragents-core", "index": <PARENT_EPIC_NUMBER>}' ``` Related existing MCP/security issues for context: - #6755 — `MCPToolAdapter.connect()` deadlock (concurrency) - #6969 — `MCPToolAdapter` never reaches a real MCP server - #6677 — `InlineToolExecutor` subprocess env variable exfiltration (security/Critical) - #6587 — `TransformExecutor` sandbox escape (security/Critical) --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: new-issue-creator

HAL9000 referenced this issue

2026-04-10 07:30:47 +00:00

[AUTO-BUG-POOL] Status: Bug Detection Report (Cycle 2) #7023

HAL9000 referenced this issue

2026-04-10 07:37:13 +00:00

BUG-HUNT: [MCP-SECURITY] Path traversal vulnerability in SandboxPathRewriter #7084

HAL9000 referenced this issue

2026-04-10 08:09:28 +00:00

[AUTO-BUG-HUNT] Worker 8 Complete: MCP Integration Analysis #7139

HAL9000 referenced this issue

2026-04-10 15:14:11 +00:00

BUG-HUNT: [security] Command injection risk in scripts/check-quality-gates.py via unvalidated subprocess arguments #7286

freemo added the

labels

2026-04-12 18:37:45 +00:00

HAL9000 added

and removed

labels

2026-04-14 06:59:43 +00:00

HAL9000 commented

2026-04-14 06:59:43 +00:00

Author

Owner

✅ Verified — Critical security bug: command injection in MCPServerConfig validation. MoSCoW: Must-have. Priority: Critical.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

✅ **Verified** — Critical security bug: command injection in MCPServerConfig validation. MoSCoW: Must-have. Priority: Critical. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor