https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-28T15:11:13.200478+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-85660 CVE-2026-85660 — cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution 2026-09-28T15:11:13.201611+00:00

Affected: MladenSU cli-mcp-server

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with_operators function when ALLOW_SHELL_OPERATORS is enabled. Attackers can use shell command substitution syntax like $(...) or backticks to execute non-allowlisted commands that bypass the ALLOWED_COMMANDS validation check.