CVE-2026-55157: 
JavaScript Análise e mitigação de vulnerabilidades

CVE-2026-55157 is an OS command injection vulnerability in the smart_user tool of the @ooples/token-optimizer-mcp npm package (a Model Context Protocol server). The vulnerability allows any MCP client that can invoke the smart_user tool to execute arbitrary shell commands on the host system with the privileges of the MCP server process. It affects versions prior to 5.1.0, with v5.0.1 confirmed as vulnerable. The advisory was originally published on June 10, 2026, and added to the GitHub Advisory Database on August 14, 2026. It carries a CVSS v3.1 base score of 8.4 (High) (GitHub Advisory, Security Advisory).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). In the smart_user tool's get-user-info operation, the caller-supplied username argument is directly interpolated into a shell command string passed to Node.js's execAsync(): `getent passwd "${username}" || grep "^${username}:" /etc/passwd`. Although the value is wrapped in double quotes, POSIX shells still evaluate command substitution constructs such as $(...) and backticks inside double-quoted strings, meaning a crafted username like $(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID) causes the shell to execute the embedded command before getent or grep receives any arguments. The attack vector is local (the attacker must be able to send MCP tool calls to the server), requires no privileges, and has low complexity — any MCP client with access to the smart_user tool can trigger it. A public proof-of-concept is included in the advisory (GitHub Advisory, Security Advisory).

Successful exploitation grants an attacker arbitrary OS command execution with the full privileges of the user account running the token-optimizer-mcp server process, resulting in high confidentiality, integrity, and availability impact. An attacker can read sensitive files, create or modify arbitrary files, exfiltrate credentials or tokens accessible to the server process, and potentially pivot to other systems or services reachable from the host. Confirmed impacts from the PoC include execution of arbitrary commands (e.g., id) and arbitrary file creation under /tmp (GitHub Advisory, Security Advisory).

A detailed, functional proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating command execution via a crafted MCP JSON-RPC tools/call request. The exploit requires no authentication or elevated privileges — only the ability to send MCP protocol messages to the server. No in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported as of the advisory publication date. EPSS score data is not yet available for this CVE, which remains in "Reserved" status (GitHub Advisory, Security Advisory).

1. Identify target: Locate a system running @ooples/token-optimizer-mcp at version 5.0.1 or earlier where the MCP server is accessible (e.g., via stdio or a local/network socket).
2. Establish MCP session: Send a valid MCP initialize JSON-RPC message to the server to establish a session, followed by a notifications/initialized message:

{"jsonrpc": "2.0", "id": "init", "method": "initialize", "params": {"protocolVersion": "2024-11-05", "capabilities": {}, "clientInfo": {"name": "poc", "version": "0"}}}
{"jsonrpc": "2.0", "method": "notifications/initialized", "params": {}}

3. Craft malicious tool call: Invoke the smart_user tool with the get-user-info operation, supplying a command substitution payload as the username argument:

{"jsonrpc": "2.0", "id": "poc", "method": "tools/call", "params": {"name": "smart_user", "arguments": {"operation": "get-user-info", "username": "$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID)", "useCache": false}}}

4. Shell evaluates payload: The server interpolates the username value into the shell command string `getent passwd "${username}" || grep "^${username}:" /etc/passwd` and passes it to execAsync(). The POSIX shell evaluates $(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID) inside the double quotes, executing the injected command as the MCP server user.
5. Confirm execution: Verify that the output file /tmp/TOKEN_OPTIMIZER_SMART_USER_ID was created and contains the result of id, confirming arbitrary command execution. Replace the payload with any desired command (e.g., reverse shell, credential exfiltration) (GitHub Advisory, Security Advisory).

• File System: Unexpected files in /tmp/ such as TOKEN_OPTIMIZER_SMART_USER_ID* or TOKEN_OPTIMIZER_SMART_USER_PWNED; new or modified files owned by the MCP server process user in unexpected locations.
• Logs: MCP server error logs containing messages like Command failed: getent passwd "$(...)" or grep "^$(...):" /etc/passwd, indicating the injected payload reached the shell.
• Process: Unusual child processes spawned by the Node.js MCP server process (e.g., /bin/sh, /bin/bash, curl, wget, python3) visible in process trees; unexpected getent or grep invocations with shell metacharacters in arguments.
• Network: Unexpected outbound connections from the host running the MCP server, particularly if the injected payload establishes a reverse shell or exfiltrates data (GitHub Advisory).

Upgrade @ooples/token-optimizer-mcp to version 5.1.0 or later, which eliminates the vulnerability by routing all smart_user lookups through argv-mode execFileSafe calls (no shell interpolation) and replacing the getent||grep pipeline with in-process fallbacks (Release v5.1.0, Fix Commit). No configuration-based workaround is available for the vulnerable versions; the only effective mitigation is upgrading. As a defense-in-depth measure, restrict which MCP clients can invoke the smart_user tool and run the MCP server under a least-privilege user account to limit the blast radius of any exploitation (GitHub Advisory).