What happened
mac-shell-mcp before 2.0.0 contains an OS command injection in execute_command: the command whitelist only inspects the bare command, while arguments are passed into a shell. An attacker (directly, or a malicious prompt steering the agent) can call a safe command like pwd with a ';' separator and run forbidden commands as the server user with no approval step.
Why it matters
Shell-executing MCP servers are the most dangerous agent tool surface — they bridge the model directly to the OS. Whitelist bypass here means prompt injection in any project file, webpage, or email the agent reads translates into arbitrary command execution on the developer's macOS machine.
Attack vector
MCP clients call an allowlisted command (e.g. pwd) with arguments containing shell metacharacters (';'), so the whitelist check on the command name does not stop the injected trailing commands from executing as the server user without approval.
Affected systems
mac-shell-mcp (cfdude) < 2.0.0 (execute_command arguments)
Mitigation
Upgrade to mac-shell-mcp 2.0.0 (commit 932ce733cde07bb30b1f186303e6692dbb5d087a; issue #45). Ensure command arguments are executed without a shell or validated against the whitelist.