Sonirico vulnerabilities
We track 3 vulnerabilities in Sonirico products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 25, 2026.
Latest Sonirico vulnerabilities
- 8.4 High severity
mcp-shell: Improper Neutralization of Special Elements used in an OS Command
mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default security.yaml allows /usr/bin/git, while security.go omits ! from containsShellMetacharacters and containsDangerousShellConstructs and applies
- 8.4 High severity
mcp-shell: Improper Neutralization of Special Elements used in an OS Command
mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash in allowed_executables, while security.go validates only the first token and checkBlockedPatternsAndCo
- 8.6 High severity
mcp-shell: Improper Neutralization of Special Elements used in an OS Command
mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, config.go initializes Security.Enabled to false, and when MCP_SHELL_SEC_CONFIG_FILE is unset, main.go starts the documented bare-binary deployment without