Poetic Tales of Vulnerable MCP Servers: Command Injection in AI Coding Assistants

MCP servers powering AI coding assistants can introduce serious command injection vulnerabilities when they blindly pass user input to shell commands without sanitization. A concrete example shows how a vulnerable `execSync` call lets an attacker append arbitrary shell commands via a crafted prompt, potentially stealing credentials, reading source code, or installing ransomware. Real-world CVEs in Create MCP Server STDIO and GitHub Kanban MCP Server confirm this is an active threat. The post emphasizes that no zero-day is needed — just an un-audited third-party MCP tool and a developer's natural fast-moving workflow.