Neo.mjs MCP FileSystemService Command Injection via Unsanitized Path Parameters

Technical Analysis

The checkSyntax() and runPlaywrightTest() functions in FileSystemService.mjs interpolate a caller-supplied absolutePath value directly into a shell command string without sanitization or escaping, classic shell metacharacter injection. The entry point is the MCP tool interface itself: any agent (or an attacker who can influence the agent's tool arguments via prompt injection, poisoned context, or a compromised upstream planner) can supply a crafted path such as one containing `; `, `|`, or `` `...` `` sequences to break out of the intended argument and execute attacker-controlled shell commands. This crosses the trust boundary between the LLM-driven agent (which is expected to only manipulate files) and the underlying OS, giving the attacker code execution with the privileges of the MCP server process. Because MCP tool calls are typically treated as trusted internal operations rather than untrusted user input, this class of bug is especially dangerous in autonomous agent pipelines where tool arguments may originate indirectly from untrusted content (e.g., a document or web page ingested by the agent).

Affected Systems

Neo.mjs, ai/mcp/server/file-system; protocols: MCP

Detection Signatures

• Log entries showing absolutePath parameters containing shell metacharacters such as ; | & $( ) `
• Unexpected child process spawns from the file-system MCP server process
• MCP tool call arguments to checkSyntax or runPlaywrightTest containing path traversal or command-separator characters
• Outbound network connections or file writes initiated shortly after a checkSyntax/runPlaywrightTest invocation

Remediation Steps

1. 1

   Upgrade to patched version

   Apply commit 88c77fc or update to the fixed Neo.mjs release that sanitizes absolutePath before shell invocation.

2. 2

   Sanitize and validate tool inputs

   Enforce strict allow-listing of file path formats, reject shell metacharacters, and use parameterized/argv-based process execution (e.g., execFile with an args array) instead of shell string concatenation.

3. 3

   Sandbox MCP tool execution

   Run the file-system MCP server in a restricted, low-privilege container or sandbox to limit blast radius if injection succeeds.

4. 4

   Constrain agent-supplied arguments

   Add a validation layer between the agent's tool call and the MCP server that inspects and normalizes path arguments before execution.

5. 5

   Monitor and alert

   Deploy process and file-integrity monitoring on hosts running MCP file-system servers to detect anomalous command execution.