CVE-2026-55157: 
JavaScript vulnerability analysis and mitigation

CVE-2026-55157 is an OS command injection vulnerability in the smart_user tool of the @ooples/token-optimizer-mcp npm package. The flaw allows any MCP client that can invoke the smart_user tool to execute arbitrary shell commands on the host system with the privileges of the MCP server process. It affects versions prior to 5.1.0 (confirmed on v5.0.1) and was first disclosed on June 10, 2026, with the advisory published to the GitHub Advisory Database on August 14, 2026. The vulnerability carries a CVSS v3.1 base score of 8.4 (High) (GitHub Advisory, Repo Advisory).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). In the smart_user tool's get-user-info operation, the caller-supplied username argument is directly interpolated into a shell command string passed to Node.js's execAsync():

const { stdout: passwdOut } = await execAsync(
  `getent passwd "${username}" || grep "^${username}:" /etc/passwd`
);

Although the value is wrapped in double quotes, POSIX shells still evaluate command substitution constructs such as $(...) and backticks inside double quotes. An attacker controlling the username argument can inject payloads like $(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID) to execute arbitrary commands before getent or grep receives its arguments. No privileges are required beyond the ability to call the smart_user MCP tool (GitHub Advisory, Repo Advisory).

Successful exploitation grants an attacker arbitrary OS command execution with the full privileges of the user running the MCP server process, resulting in high confidentiality, integrity, and availability impact. An attacker can read sensitive files, create or modify arbitrary files, exfiltrate data, install backdoors, or disrupt the host system. Because MCP servers often run in developer or CI/CD environments with broad local access, exploitation could facilitate lateral movement to source code repositories, secrets stores, or connected infrastructure (GitHub Advisory, Repo Advisory).

A working proof-of-concept (PoC) is publicly available in the GitHub Security Advisory, demonstrating confirmed command execution by writing the output of id to a file under /tmp. The attack requires only local access to invoke the MCP tool — no authentication or elevated privileges are needed. No in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported at this time. The CVE status is currently listed as Reserved (GitHub Advisory, Repo Advisory).

1. Identify a vulnerable instance: Confirm the target is running @ooples/token-optimizer-mcp version 5.0.1 or earlier with the smart_user tool enabled.
2. Set up MCP communication: Establish a JSON-RPC 2.0 session with the MCP server over its stdio transport (or other configured transport). Send an initialize message followed by a notifications/initialized notification.
3. Craft the malicious payload: Construct a tools/call request targeting the smart_user tool with operation: "get-user-info" and a username value containing a command substitution payload, e.g.:

   {
     "operation": "get-user-info",
     "username": "$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_PWNED)",
     "useCache": false
   }

4. Send the request: Transmit the crafted JSON-RPC message to the MCP server. The server interpolates the username value into the shell command string and passes it to execAsync().
5. Achieve command execution: The POSIX shell evaluates the $(...) substitution inside the double-quoted string, executing the injected command as the MCP server's OS user. The attacker can substitute the payload with any desired command (e.g., reverse shell, data exfiltration, persistence mechanism) (GitHub Advisory, Repo Advisory).

• File System: Unexpected files created under /tmp/ with names matching TOKEN_OPTIMIZER_SMART_USER_ID* or TOKEN_OPTIMIZER_SMART_USER_PWNED; new or modified files in sensitive directories owned by the MCP server's user account.
• Logs: MCP server logs (e.g., /tmp/token_optimizer_smart_user_poc.log) containing error messages such as Command failed: getent passwd "$(...)" with embedded shell payloads in the command string; unusual execAsync error output referencing injected command substitution syntax.
• Process: Unexpected child processes spawned by the Node.js MCP server process (e.g., /bin/sh, id, curl, wget, bash) visible in process trees; unusual outbound network connections from the MCP server process.
• Network: Outbound connections to unknown external hosts initiated by the Node.js process running the MCP server, potentially indicating reverse shell or data exfiltration activity (GitHub Advisory).

Upgrade to @ooples/token-optimizer-mcp version 5.1.0 or later, which eliminates the vulnerability by routing all smart_user lookups through argv-mode execFileSafe helpers (no shell interpolation) and replacing the getent||grep pipeline with in-process fallbacks. The fix was introduced in commit b4ee96d and released on July 20, 2026. No configuration-based workaround is available for versions prior to 5.1.0; the only safe remediation is upgrading (GitHub Release, Fix Commit).

The vulnerability was reported by security researcher mcfly-zzh and published as a GitHub Security Advisory (GHSA-49mq-fc6q-3h46) by the repository owner (ooples) on June 10, 2026. The fix was incorporated into a broader security hardening commit that addressed multiple OS command injection issues across several smart_* tools in the same package. No significant broader media coverage or notable public social media discussion has been identified beyond the advisory and associated tracking sources (GitHub Advisory, Repo Advisory).