What happened
A command-injection flaw in mcollina mcp-ripgrep up to 0.4.0 affects the Advanced Search Tool's fileType argument, which reaches a shell invocation while sibling arguments are escaped via escapeShellArg. The maintainer notes the tool runs ripgrep on the machine and argues it is an expected design consideration, so the finding is disputed; a public PoC exists. The CVE is tagged 'disputed'.
Why it matters
mcp-ripgrep is an MCP server that executes shell commands for an agent's search tool; if an attacker can steer the fileType argument (e.g., via prompt injection in search requests), it becomes a local command-injection sink on the machine running the MCP server. Even though it is disputed and local, it illustrates the broader class of MCP servers that pass agent-supplied input to a shell.
Attack vector
Steered fileType argument reaching a shell invocation in the MCP server (local attack surface)
Affected systems
mcollina mcp-ripgrep <= 0.4.0
Mitigation
Escape the fileType argument consistently / avoid passing it to the shell; treat MCP server inputs as untrusted