AI-SDLC MCP GitHub issue and pull-request tools constructed shell commands using an untrusted repository parameter and execSync. An agent or caller had to influence the repo tool argument before the GitHub CLI was invoked under the MCP host account. The resulting shell string could interpret metacharacters as commands rather than as a repository identifier.…
Inspect the ClaimsCase · DiggingBeagle record
AI-SDLC MCP arguments reached a shell through repository-name interpolation
AI-SDLC MCP GitHub issue and pull-request tools constructed shell commands using an untrusted repository parameter and execSync. The resulting shell string could interpret metacharacters as commands rather than as a repository identifier.
Scope
An agent or caller had to influence the repo tool argument before the GitHub CLI was invoked under the MCP host account. The source patch replaced shell invocation with argument-vector execution; a first fixed npm package version was not independently confirmed.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- not established
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The inspected maintainer pull request confirms unsafe shell construction and the source-level change to argument-vector execution. An independently executed malicious tool-argument reproduction and a published patched package have not been established; the impact band is therefore ungraded.
Assessed Oct 29, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP23-AI-SDLC-MCP-GH-SHELL-1 · CLM-ENRICH-20261029-01 · AI-SDLC MCP GitHub repository shell injection fix
At a glance
The resulting shell string could interpret metacharacters as commands rather than as a repository identifier.
Read the implicationsThe source patch replaced shell invocation with argument-vector execution; a first fixed npm package version was not independently confirmed.
Limits and uncertaintyFull account
AI-SDLC MCP GitHub issue and pull-request tools constructed shell commands using an untrusted repository parameter and execSync.
An agent or caller had to influence the repo tool argument before the GitHub CLI was invoked under the MCP host account. The resulting shell string could interpret metacharacters as commands rather than as a repository identifier.
The source patch replaced shell invocation with argument-vector execution; a first fixed npm package version was not independently confirmed. Use the patched source once distributed, validate repository syntax and replace shell-interpreted strings with execFileSync argument arrays.
Evidence interpretation and control boundary. The privileged operation is the MCP host spawning gh, not the repository label itself. Repository syntax is data until the wrapper places it inside a shell program; the patch changes that trust boundary by supplying executable and argument vector separately. The reviewed pull request is evidence of a source-level repair, but an operator should not assume a packaged release is patched solely because the branch contains the change.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Claims & evidence
CLM-ENRICH-20261029-01The maintainer pull request replaces shell-interpreted gh commands in check_issue and check_pr_status with argument-vector process execution; this verifies a source patch, not the first fixed distributed package.supported
Basis: reported finding
- supportsAI-SDLC MCP GitHub repository shell injection fixpatch commit artifact
ai-sdlc pull request 1982: execSync to execFileSync and repository validation
CLM-CP23-AI-SDLC-MCP-GH-SHELL-1AI-SDLC MCP GitHub issue and pull-request tools constructed shell commands using an untrusted repository parameter and execSync. An agent or caller had to influence the repo tool argument before the GitHub CLI was invoked under the MCP host account. The resulting shell string could interpret metacharacters as commands rather than as a repository identifier.supported
Basis: reported finding
- supportsAI-SDLC MCP GitHub repository shell injection fixpatch commit artifact
ai-sdlc pull request 1982: execSync to execFileSync and repository validation
Implications
The resulting shell string could interpret metacharacters as commands rather than as a repository identifier.
Controls and mitigations
- Use the patched source once distributed, validate repository syntax and replace shell-interpreted strings with execFileSync argument arrays.
Unknowns and contradictions
- The source patch replaced shell invocation with argument-vector execution; a first fixed npm package version was not independently confirmed.
Sources and citation
Material revision history
- Oct 29, 2026 · Canonical change recorded · new in release · revision 202