https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-08T18:33:11.977811+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-55157 fkie_cve-2026-55157 2026-10-08T18:33:11.996168+00:00

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smart_user tool. Any MCP client that can call the smart_user tool can execute arbitrary shell commands through the username argument of the get-user-info operation. The commands execute with the privileges of the user running the token-optimizer-mcp server. This issue has been patched in version 5.1.0.

 https://db.gcve.eu/vuln/ghsa-49mq-fc6q-3h46 GHSA-49mq-fc6q-3h46 — Token Optimizer MCP: OS command injection in smart_user via username in get-user-info 2026-10-08T18:33:11.996226+00:00

Affected: npm: @ooples/token-optimizer-mcp

### Summary

`token-optimizer-mcp` is vulnerable to OS command injection in the `smart_user` tool.

The `get-user-info` operation accepts a user-controlled `username` argument and later interpolates it into a shell command executed through `execAsync()`:

```ts getent passwd "${username}" || grep "^${username}:" /etc/passwd ```

Although the value is wrapped in double quotes, POSIX shells still evaluate command substitution such as `$(...)` and backticks inside double quotes. As a result, an MCP client can provide a crafted username such as:

```text $(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID) ```

and execute arbitrary local commands with the privileges of the user running the MCP server.

This is a CWE-78 OS command injection issue.

Tested version:

```text @ooples/token-optimizer-mcp v5.0.1 MCP serverInfo.name: token-optimizer-mcp MCP serverInfo.version: 0.2.0 ```

This issue is not related to the current `npm audit` dependency advisories. The vulnerability is in `token-optimizer-mcp`'s own tool implementation.

---

### Details

The vulnerable code path is in the `smart_user` implementation.

The `username` argument is eventually passed into a shell command similar to:

```ts const { stdout: passwdOut } = await execAsync( `getent passwd "${username}" || grep "^${username}:" /etc/passwd` ); ```

The problem is that `username` is controlled by the MCP tool caller and is inserted into a command string executed by a shell.

Double quotes do not make this safe. In POSIX she…