Agentic-Flow MCP Server Command Injection via Unsanitized Tool Parameters

Technical Analysis

The vulnerability stems from classic shell command string interpolation: tool parameters accepted from MCP tool calls (e.g., agent name, task description, target language, agentdb identifier) were concatenated into shell command strings and executed via Node's execSync() without escaping or use of safe argument arrays (execFile/spawn with array args). The entry point is any MCP tool invocation reaching the affected files, including agent execute/list/parallel tools, swarm orchestration, and pretrain hooks — meaning both direct user input and untrusted content relayed by an upstream LLM agent (e.g., from a compromised prompt or tool-chained call) could inject shell metacharacters to run arbitrary commands. This crosses agent/tool boundaries because in agent orchestration platforms, tool parameters are often populated dynamically from LLM-generated text or downstream agent output, so a prompt injection or malicious agent response can indirectly trigger the command injection without a human ever typing the payload. Successful exploitation grants the attacker full OS command execution with the privileges of the MCP server process, enabling data exfiltration, lateral movement, persistence, or further agent/tool compromise.

Affected Systems

agentic-flow, claude-flow-sdk, FastMCP; protocols: MCP

Detection Signatures

• Shell metacharacters (;, |, &&, `, $(), >, <) present in agent/task/name/language/agentdb tool parameters logged by MCP servers
• Unexpected child processes spawned by node process hosting agentic-flow MCP server
• execSync/child_process invocations correlated with MCP tool call payloads containing non-alphanumeric special characters
• Anomalous outbound connections or file system access immediately following MCP tool invocation
• Presence of agentic-flow versions < 2.0.14 in dependency manifests

Remediation Steps

1. 1

   Upgrade agentic-flow

   Update to agentic-flow version 2.0.14 or later, which fixes the unsanitized shell interpolation in the listed MCP server and tool files.

2. 2

   Replace shell string interpolation with safe execution APIs

   Audit any custom forks or wrappers to ensure execSync() with string concatenation is replaced with execFile()/spawn() using argument arrays, avoiding shell interpretation entirely.

3. 3

   Input validation and allowlisting

   Enforce strict allowlists/regex validation on tool parameters (agent, task, name, language, agentdb) before they reach any process execution logic.

4. 4

   Least-privilege MCP server execution

   Run MCP server processes under a restricted, non-privileged service account with minimal filesystem and network access to limit blast radius of any future injection.

5. 5

   Monitor and audit tool call logs

   Implement logging and alerting for MCP tool invocations containing shell metacharacters or anomalous parameter patterns.