SG-086: MCP STDIO Argument Injection
Severity: HIGH
MCP server declaration (mcpServers / servers entry) has `args` containing shell metacharacters ($(...), backticks, |, ;, &&), env-var expansion, or `--config=<URL>` pulling remote config. Vectors: CVE-2025-68143/-68144/-68145 (Anthropic git MCP), CVE-2026-30615 (Windsurf STDIO RCE).
Fires when
- An MCP server declaration (mcpServers/servers entry, or a command+args pair) has an `args` entry containing shell metacharacters like `$(...)`, backticks, `|`, `;`, or `&&`.
- An `args` entry passes a `--config=`/`-c` flag whose value is a URL, env-var expansion, or shell substitution, letting an attacker load a poisoned remote config.
Related CVEs
Remediation
Pin every MCP server `args` entry to a literal value: a fixed flag name, a local file path, or a constant. Reject shell metacharacters ($(...), backticks, |, ;, &&, >), env-var expansion ($VAR, ${VAR}, %VAR%), and `--config=<URL>` pointing to remote hosts. If the MCP server requires runtime configuration, write it to a sealed local file the user reviews.