title: Unsandboxed Command Execution via Dynamic MCP Server Config (command/args Injection) id: ATR-2026-02141 rule_version: 2 status: experimental description: | Detects a dynamic/custom MCP server configuration object (a JSON body with "command" and "args" fields, the shape used by Flowise's Custom MCP and similar "bring your own MCP server" features) that either (a) sets "command" directly to a raw shell/network binary (nc, ncat, bash, sh, python, perl) with args forming a reverse shell or arbitrary "-c" execution, or (b) uses one of three documented allowlist/blocklist-bypass idioms for otherwise-permitted binaries: "docker build " (fetches and runs an attacker Dockerfile, bypassing a blocklist that only covers "run"/"exec"), "npx --yes " (the long-flag alias for "-y" that a short-flag-only blocklist misses), or "node //" (a double-slash path that a regex anchored on a single leading "/" fails to block, loading and executing an arbitrary stored file). Mined from GHSA-6933-jpx5-q87q (CVE-2025-71336, Flowise's Custom MCP endpoint executes "command"/"args" unsandboxed and by default unauthenticated) and GHSA-m99r-2hxc-cp3q (CVE-2026-56274, three distinct validateCommandFlags/validateArgsForLocalFileAccess bypasses for the same feature). Generalized beyond Flowise since any tool that accepts a structured command+args MCP-server config is exploitable the same way regardless of the surrounding product. author: ATR Community (CVE sweep) date: 2026/07/11 schema_version: '0.1' detection_tier: pattern maturity: experimental severity: critical references: owasp_llm: - LLM06:2025 owasp_agentic: - ASI02:2026 mitre_attack: - T1059 - Command and Scripting Interpreter mitre_atlas: - AML.T0053 - LLM Plugin Compromise cve: - CVE-2025-71336 - CVE-2026-56274 external: - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6933-jpx5-q87q - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-m99r-2hxc-cp3q metadata_provenance: owasp_llm: human-reviewed owasp_agentic: human-reviewed mitre_attack: human-reviewed mitre_atlas: human-reviewed cve: nvd-sync compliance: eu_ai_act: - article: '15' context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their behaviour or environment; this rule detects a dynamic MCP server configuration weaponised for unsandboxed command execution or blocklist-bypass RCE. strength: primary - article: '9' context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control for the MCP-config command-injection risk class. strength: secondary nist_ai_rmf: - subcategory: MG.2.3 context: Treating dynamic MCP server config command injection as an identified AI risk requires active runtime countermeasures; this detection rule is the primary risk treatment implementation. strength: primary - subcategory: MP.5.1 context: Identifying MCP config command/args injection as an AI risk to be catalogued in the organizational risk register. strength: secondary iso_42001: - clause: '8.1' context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by this rule's detection of MCP server config command injection. strength: primary - clause: '8.3' context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented via this rule's runtime detection of the injection attempt. strength: secondary tags: category: tool-poisoning subcategory: mcp-config-command-injection scan_target: mcp confidence: high agent_source: type: mcp_exchange framework: - any provider: - any detection: condition: any conditions: - field: content operator: regex value: (?i)"command"\s*:\s*"(?:nc|ncat)"[\s\S]{0,30}"args"\s*:\s*\[[^\]]{0,80}-e\b description: MCP server config command set to nc/ncat with a -e reverse-shell flag in args - field: content operator: regex value: (?i)"command"\s*:\s*"(?:bash|sh|python3?|perl)"[\s\S]{0,20}"args"\s*:\s*\[\s*"-c"\s*,\s*"(?=(?:[^"\\]|\\.)*(?:curl\b|wget\b|\bnc\b|\bncat\b|/dev/tcp|base64\s+(?:-d|--decode)|\beval\(|\bexec\(|os\.system|subprocess\.|reverse[_ -]?shell|mkfifo|\.ssh/|\.aws/|\.gnupg/|id_rsa|/etc/passwd|/etc/shadow|credentials\.json|\$\(|`))(?:[^"\\]|\\.)*" description: MCP server config command set to a shell/interpreter with -c whose payload itself contains a dangerous signal (network fetch, reverse shell, credential-file read, or code-exec obfuscation) — v2 tightened; bare interpreter+-c with a benign one-liner like npm install && npm start no longer fires - field: content operator: regex value: (?i)"command"\s*:\s*"docker"[\s\S]{0,20}"args"\s*:\s*\[\s*"build"[^\]]{0,60}https?:// description: docker build with a remote URL argument — Dockerfile-fetch RCE bypassing a run/exec-only blocklist - field: content operator: regex value: (?i)"command"\s*:\s*"npx"[\s\S]{0,20}"args"\s*:\s*\[\s*"--yes" description: npx --yes long-flag alias bypassing a -y-only blocklist to auto-install an attacker package - field: content operator: regex value: (?i)"command"\s*:\s*"node"[\s\S]{0,20}"args"\s*:\s*\[\s*"\/\/[^"]+ description: node invoked with a double-slash path bypassing a single-leading-slash traversal check false_positives: - Legitimate MCP server configs using bash/sh/python with -c for a benign one-liner with no network-fetch/reverse-shell/credential-read/exec-obfuscation signal (e.g. "bash -c 'npm install && npm start'") — v2 requires the -c payload itself to contain a dangerous-vocabulary match, not just the bare interpreter+-c shape - docker build with a local Dockerfile path or build context (no https:// URL argument) - npx -y (short flag) for routine package execution — this rule only fires on the --yes long-flag alias - node invoked with a normal single-leading-slash absolute path or relative script name response: actions: - block_input - alert message_template: | [ATR-2026-02141] Dynamic MCP server configuration specifies a command/args pair matching a known unsandboxed-execution or validation-bypass idiom — treat as an attempted RCE via the custom-MCP feature, not a routine tool config. confidence: 82