OASB
Attacks/MCP Exploitation/MCP-004
CRITICALCWE-78

MCP-004 MCP Command Injection

MCP Exploitation: Attempts to exploit MCP tool call parameters (path traversal, command injection, SSRF)

Description

Attempts shell command injection via MCP execute tool

Remediation

Sanitize command inputs. Use command allowlists. Block shell metacharacters (;, |, &&, ||, `).

Severity

CRITICAL

OASB Control

2.3

CWE

CWE-78
PreviousMCP-003 MCP Home Directory TraversalNextMCP-005 MCP Command Injection via Pipe