MCP Watch: a security scanner that runs your URL as a command
A scanner built to audit Model Context Protocol servers passed the GitHub URL you gave it straight to a system shell, so a crafted URL could run any command on the machine doing the scan.
- Package
- mcp-watch (npm)
- Affected
- 0.1.2 and earlier
- Fixed in
- No patched version listed
- Weakness
- CWE-78 OS command injection
- Severity
- Critical, CVSS 3.1 score 9.8
- Advisory
- GHSA-27m7-ffhq-jqrm
Severity
9.8CVSS 3.1
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What was the issue
MCP Watch scans MCP servers for security problems by cloning their repositories. The cloneRepo method of its MCPScanner class passed the user-supplied githubUrl to execSync, which runs the string through a system shell, without any sanitization. Shell metacharacters appended to the URL were executed as commands.
Impact
Anyone who could choose the URL being scanned could run arbitrary commands with the privileges of the scanning process. That matters most where scans run automatically, such as in CI or a shared service that accepts URLs from users. A security tool became the attack path.
What to do
The advisory lists no patched version. Don't feed untrusted URLs to mcp-watch 0.1.2 or earlier. In your own code, call execFile or spawn with an argument array instead of building shell strings, and validate URLs before use.
Disclosure timeline
Reported privately to the maintainer.
Published in NVD.
Added to the GitHub Advisory Database as GHSA-27m7-ffhq-jqrm.
The takeaway. Never hand user input to a shell. Pass arguments as an array so there is no shell to inject into.
