Command Injection Vulnerability in Sonirico MCP-Shell by Sonirico
CVE-2025-61489

6.5MEDIUM

Key Information:

Vendor

Sonirico

Status
MCP-Shell
Vendor
CVE Published:
7 January 2026

What is CVE-2025-61489?

A command injection vulnerability exists within the shell_exec function of Sonirico's MCP-Shell v0.3.1. This flaw enables attackers to supply a malicious command string, which can lead to the execution of arbitrary commands on the host system. Proper validation and sanitization of user inputs are crucial to mitigate this security risk.

References

https://github.com/sonirico/mcp-shell
https://github.com/sonirico/mcp-shell/issues/4

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.