fkie_cve-2026-55157

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smart_user tool. Any MCP client that can call the smart_user tool can execute arbitrary shell commands through the username argument of the get-user-info operation. The commands execute with the privileges of the user running the token-optimizer-mcp server. This issue has been patched in version 5.1.0.

GHSA-49mq-fc6q-3h46 — Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Affected: npm: @ooples/token-optimizer-mcp

### Summary

`token-optimizer-mcp` is vulnerable to OS command injection in the `smart_user` tool.

The `get-user-info` operation accepts a user-controlled `username` argument and later interpolates it into a shell command executed through `execAsync()`:

```ts getent passwd "${username}" || grep "^${username}:" /etc/passwd ```

Although the value is wrapped in double quotes, POSIX shells still evaluate command substitution such as `$(...)` and backticks inside double quotes. As a result, an MCP client can provide a crafted username such as:

```text $(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID) ```

and execute arbitrary local commands with the privileges of the user running the MCP server.

This is a CWE-78 OS command injection issue.

Tested version:

```text @ooples/token-optimizer-mcp v5.0.1 MCP serverInfo.name: token-optimizer-mcp MCP serverInfo.version: 0.2.0 ```

This issue is not related to the current `npm audit` dependency advisories. The vulnerability is in `token-optimizer-mcp`'s own tool implementation.

---

### Details

The vulnerable code path is in the `smart_user` implementation.

The `username` argument is eventually passed into a shell command similar to:

```ts const { stdout: passwdOut } = await execAsync( `getent passwd "${username}" || grep "^${username}:" /etc/passwd` ); ```

The problem is that `username` is controlled by the MCP tool caller and is inserted into a command string executed by a shell.

Double quotes do not make this safe. In POSIX she…

Most recent entries from all

fkie_cve-2026-55157

GHSA-49mq-fc6q-3h46 — Token Optimizer MCP: OS command injection in smart_user via username in get-user-info