What happened
Published 2026-08-20 (unrated CVSS), this command-injection vulnerability in Neo.mjs's MCP file-system server lets a caller-controlled path value be unsafely interpolated into a shell command executed by the server's syntax-check and Playwright-test tool actions.
Why it matters
This is another instance of the recurring MCP tool-surface pattern — an AI-agent-callable tool action that shells out with insufficiently sanitized input — turning what should be a scoped file/test-check tool into arbitrary OS command execution reachable by any MCP client or injected prompt content.
Attack vector
The checkSyntax() and runPlaywrightTest() functions in FileSystemService.mjs unsafely interpolate caller-controlled absolutePath values directly into shell commands, enabling arbitrary OS command execution when an MCP client (or a prompt-injected agent) supplies a crafted path.
Affected systems
Neo.mjs ai/mcp/server/file-system MCP server (FileSystemService.mjs)
Mitigation
Apply the upstream fix (commit 5acc564ea1b278bca5fab1f8f397a6ba9b849d75); avoid shell interpolation of caller-supplied paths — use parameterized subprocess calls instead.