The pivot is npx. shlex.split() parses the command string, validate_mcp_command() confirms the first token is on the allowlist, and returns the arguments untouched to a subprocess spawner [2]. npx accepts -c, which runs an arbitrary shell string, so `npx -y -c 'PAYLOAD'` satisfies a check that only ever looked at the word npx [3]. The allowlist did exactly what it was written to do. It guarded the wrong token.
There is a second way in. allowed_executables defaults to None, and the validation code reads None as allow-everything. A developer who deletes that line while tidying the config opens the gate to any binary, not just wrappers like npx or uvx [4].
Reaching the sink takes one unauthenticated step. The /mcp route is registered on the FastAPI router in every build; the only gates are the runtime features.mcp.enabled flag and, where someone configured it, auth on /mcp [5]. The proof of concept opens a Socket.IO session for a sessionId, posts a fullCommand, and the server runs it before the MCP handshake even fails, writing the output of `id` to /tmp/rce_proof [6]. MCP has shipped disabled by default since 2.7.0, which is the main reason this is not everywhere [7].
The fix says which control mattered. Version 2.12.0 does not add stricter argument parsing. It removes fullCommand from the client request entirely; stdio servers are declared by the developer in config.toml and picked by name, so the command never crosses from client to server and there is nothing left to sanitize [8]. The reliable rule for anyone shipping MCP stdio servers is narrower than "validate arguments": do not take the command from the caller.
Two caveats. The upgrade breaks configs. Legacy [features.mcp.stdio] sections and the allowed_executables setting will fail to start once MCP is enabled, until they are migrated to [[features.mcp.servers]] [9]. And the same release closes a companion SSRF tracked as CVE-2026-45019; setting features.mcp.enabled = false prevents exploitation of both [10].
