tumf/mcp-shell-server

v1.1.2 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 8d MCP Developer Tools

✓ No known CVEs patched

This release patches 1 known CVE

Topics

audit-log command-whitelist mcp model-context-protocol security shell

Affected surfaces

rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 8d

Git CLI v1.1.2 rejects command‑scoped configuration overrides and external execution paths to block RCE.

Why it matters: All versions <=1.1.1 are vulnerable; upgrade to v1.1.2 immediately to prevent remote code execution.

AI summary

Rejects command-scoped Git configuration overrides and external execution paths to prevent RCE.

Type	Severity	Summary	CVE
Security	Critical	Rejects all command-scoped Git configuration overrides in versions <=1.1.1. Rejects all command-scoped Git configuration overrides in versions <=1.1.1. Source: llm_adapter@2026-07-18 Confidence: high	—
Security	High	Rejects Git external execution via multiple options and transport program settings. Rejects Git external execution via multiple options and transport program settings. Source: llm_adapter@2026-07-18 Confidence: high	—

Full changelog

Reject all command-scoped Git configuration overrides (git -c <name=value> and git -c<name=value>). Versions <=1.1.1 are affected.
Reject Git external execution through --config-env, --exec-path, clone configuration, transport program options, and accepted abbreviated forms.

PyPI: https://pypi.org/project/mcp-shell-server/1.1.2/

Rejects all command-scoped Git configuration overrides (e.g., `git -c ...`) and external execution paths via `--config-env`, `--exec-path`, clone config, transport program options; affects versions <=1.1.1.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track tumf/mcp-shell-server

Get notified when new releases ship.

About tumf/mcp-shell-server

A secure shell command execution server implementing the Model Context Protocol (MCP)