title: LibreChat MCP STDIO Argument Injection (CVE-2026-22252)
id: ATR-2026-00417
rule_version: 1
status: experimental
description: |
  Detects exploitation of CVE-2026-22252 in LibreChat. The MCP STDIO adapter passes user-supplied tool arguments to child_process.spawn without quoting, allowing argv-level injection: an attacker supplies tool args containing shell-metacharacters or argument-separator sequences (e.g. `; curl evil`, `--option=$(id)`, `\\n--exec=...`) which the spawned process interprets as additional flags or shell commands. Part of the OX Security MCP-by-design batch (2026-04-15). Distinct from CVE-2026-40933 (config-time bypass) — this one targets the runtime argv channel.
author: ATR Community
date: 2026/05/04
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM01:2025
    - LLM05:2025
  owasp_agentic:
    - ASI03:2026
    - ASI05:2026
  mitre_atlas:
    - AML.T0051.001 - Indirect
    - AML.T0040 - AI Model Inference API Access
  mitre_attack:
    - T1059 - Command and Scripting Interpreter
    - T1068 - Exploitation for Privilege Escalation
  cve:
    - CVE-2026-22252
metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: CVE-2026-22252 LibreChat MCP STDIO adapter passes user-controlled tool arguments to child_process.spawn without quoting, allowing argv-level injection of additional flags or shell commands; Article 15 cybersecurity requirements mandate that high-risk AI systems sanitize and quote all attacker-influenced inputs before they reach process-spawning sinks.
      strength: primary
    - article: '14'
      context: Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the agent-manipulation technique (LibreChat MCP STDIO Argument Injection (CVE-2026-22252)) would bypass or undermine that oversight.
      strength: secondary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the agent-manipulation technique (LibreChat MCP STDIO Argument Injection (CVE-2026-22252)).
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Argv-level injection through tool arguments is an adversarial input attack identified under MP.5.1; sanitization of tool-arg fields before spawn() is the canonical control.
      strength: primary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the agent-manipulation technique (LibreChat MCP STDIO Argument Injection (CVE-2026-22252)).
      strength: primary
    - subcategory: MG.2.3
      context: NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the agent-manipulation technique (LibreChat MCP STDIO Argument Injection (CVE-2026-22252)) so the risk can be treated.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: Operational controls under clause 8.1 must include argv-quoting policies and metacharacter denylists for any tool-runtime spawn surface that accepts agent-supplied arguments.
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the agent-manipulation technique (LibreChat MCP STDIO Argument Injection (CVE-2026-22252)) is such a treatment.
      strength: secondary
tags:
  category: agent-manipulation
  subcategory: argv-injection
  scan_target: mcp
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - librechat
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - MCP server documentation showing example tool args that contain quotation marks or escaped strings.
    - Code search hits in security tooling that scan for the CVE-2026-22252 PoC pattern.
    - Skill snippets demonstrating shell-quoting libraries in educational context.
  conditions:
    - field: tool_response
      operator: regex
      value: (?i)"args"\s*:\s*\[[^\]\n]{0,400}"[^"\n]{0,200}(?:;\s*(?:\w|/)|&&\s*\S|\|\|\s*\S|`[a-zA-Z][a-zA-Z0-9_]*`|\$\([a-zA-Z])
      description: Tool args array contains a shell metacharacter followed by an actionable token (;<word>, &&<x>, ||<x>, `cmd`, $(cmd)) — argv injection signature; bounded to single-line single-arg to avoid markdown code-fence FPs
    - field: tool_response
      operator: regex
      value: (?i)"args"\s*:\s*\[[^\]]*"[^"]*\\(?:n|r|t)[^"]*--?[a-z]+="?[^"]*"
      description: Tool args containing newline/CR/tab escapes followed by what looks like an additional flag — argv-separator injection
    - field: tool_response
      operator: regex
      value: (?i)"args"\s*:\s*\[[^\]]*"--?(?:exec|eval|command|script|run|shell)=[^"]+"
      description: Tool args injecting --exec / --eval / --command flag through argv — escapes the intended arg surface
    - field: content
      operator: regex
      value: (?i)librechat[^\n]{0,80}(?:mcp|tool[_\s]?args|child_process\.spawn|spawn\([^)]*args)[^\n]{0,200}(?:inject|escape|quote\s+bypass|argv)
      description: Skill content describing LibreChat MCP argv injection — attack-language hint
    - field: content
      operator: regex
      value: (?i)cve-?2026-?22252[^\n]{0,200}(?:poc|payload|exploit)
      description: Direct CVE reference with exploit framing
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00417] HIGH: LibreChat MCP argv-injection pattern detected (CVE-2026-22252). Tool args contain shell metacharacters or argument- separator sequences that escape the intended argv surface. Block invocation; apply argv quoting; upgrade LibreChat to the patched release.
confidence: 78