title: MCP stdio server config command injection via unvalidated test endpoints
id: ATR-2026-00567
rule_version: 2
status: experimental
description: An MCP server config (command/args/env for the stdio transport) supplied in an agent request spawns the given command on the host. Detects a config whose command is a raw shell / carries shell metacharacters, or whose args pass a code-execution flag (-c/-e) with a payload. Generalizes beyond CVE-2026-42271 (LiteLLM) to any endpoint that accepts an MCP stdio config.
author: ATR Community
date: 2026/06/02
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  cve:
    - CVE-2026-42271
  cwe:
    - CWE-77
    - CWE-78
  ghsa:
    - GHSA-v4p8-mg3p-g94g
  external:
    - https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g
  owasp_llm:
    - LLM06:2025
  owasp_agentic:
    - ASI05:2026
  mitre_atlas:
    - AML.T0049 - Exploit Public-Facing Application
metadata_provenance:
  cve: human-authored
  cwe: human-authored
compliance:
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (MCP stdio server config command injection via unvalidated test endpoints).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (MCP stdio server config command injection via unvalidated test endpoints).
      strength: secondary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (MCP stdio server config command injection via unvalidated test endpoints).
      strength: primary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (MCP stdio server config command injection via unvalidated test endpoints).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (MCP stdio server config command injection via unvalidated test endpoints).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (MCP stdio server config command injection via unvalidated test endpoints) as a treatment control.
      strength: secondary
tags:
  category: tool-poisoning
  scan_target: runtime
  confidence: high
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  condition: any
  false_positives: []
  conditions:
    - field: content
      operator: regex
      value: (?i)"command"\s*:\s*"(?:(?:/(?:usr/)?bin/)?(?:bash|sh|zsh|dash)"|[^"]*[;&|`$][^"]*")[^{}]{0,400}"(?:args|env|transport)"\s*:|"(?:args|transport)"\s*:[^{}]{0,400}"command"\s*:\s*"(?:(?:/(?:usr/)?bin/)?(?:bash|sh|zsh|dash)"|[^"]*[;&|`$])
      description: MCP stdio config (a command next to its args, env or transport field in the same object) whose command is a raw shell or contains shell metacharacters. A bare {"command":"..."} is the argument shape of ordinary shell tools and is not matched
    - field: content
      operator: regex
      value: (?i)"args"\s*:\s*\[[^\]]*"(?:-c|-e|--eval|-Command)"\s*,\s*"[^"]*(?:import |require\(|child_process|os\.|exec|spawn|subprocess|System\.)
      description: MCP stdio config args pass a code-execution flag (-c/-e) with a payload
response:
  actions:
    - alert
  notify:
    - security_team