CVE-2025-61489: Sonirico Mcp-Shell

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

A command injection vulnerability in the shell_exec function of sonirico mcp-shell v0.3.1 allows attackers to execute arbitrary commands via supplying a crafted command string.

Affected products

• Sonirico Mcp-Shell: version 0.3.1 only

Published 2026-01-07. Last modified 2026-06-17.