This issue is fixed. Upgrade to 2.0.3 or later.

Threat model

MCP tool arguments are attacker-influenced. They are produced by an LLM from the content the agent processes — documents, web pages, tool output — so indirect prompt injection puts an attacker in control of the values a tool handler receives. A handler that feeds any of those values into a shell turns that influence into code execution on the host running the MCP server. This is the same model as the precedent case aws-mcp-server / CVE-2026-5058.

The consequence is that "the caller is a trusted LLM" is not a mitigation. Tool arguments are untrusted input.

Execution

src/helpers/runAnsible.ts in 2.0.0 built an argument array and then ran it with the shell enabled:

With shell: true Node does not execute ansibleCmd[0] with the remaining elements as argv. It joins the whole array into one string and hands it to /bin/sh -c, with no quoting or escaping applied to the elements. Any element carrying ;, &&, |, backticks or $() therefore breaks out of the intended command.

The reachable path is the executeDeployment MCP tool (src/tools/executeDeployment.ts), which forwards caller-supplied extraVars into the array as --extra-vars key=value. A value of ; touch /tmp/marker ; yields:

A secondary sink in the same version interpolated projectRoot into execSync('ansible-vault encrypt ' + vaultPath).

Reproduction

poc/driver.mjs calls runAnsible directly with a crafted extraVars value and checks for the marker file. ansible-playbook does not need to be installed — the injected command runs in the same /bin/sh -c string regardless of whether the leading binary resolves.

Expected on an affected version:

Validated 2026-06-01 in an isolated container and re-validated 2026-06-13 with a benign touch marker. Run it only against infrastructure you are authorized to test.

Detection

• Any --extra-vars value reaching ansible-playbook that contains ;, &&, ||, |, a backtick or $(. Legitimate Ansible variable values essentially never do.
• A sh -c process whose command line contains ansible-playbook and a second command after a separator — a process-tree signal (auditd, eBPF, Falco, EDR) that does not depend on application logging.
• Unexpected children of the MCP server process. ansible-playbook, git and ansible-vault are expected; a shell, an interpreter or a network client is not.
• MCP tool-call logs where executeDeployment arguments contain shell metacharacters. Log tool arguments — most MCP deployments do not, and it is the only place the injected value is visible in application terms.

MITRE ATT&CK T1059.004 Command and Scripting Interpreter: Unix Shell.

Mitigation

Upgrade to @webfer/mcp-ansible-drupal 2.0.3 or later. The current source calls spawn(ansibleCmd[0], ansibleCmd.slice(1), { … }) with no shell option, so the array is passed as argv and metacharacters lose their meaning.

The general rule for MCP tool handlers, and what the fix applies here:

• Never enable shell: true when an argument array is already available. The array form exists precisely to avoid the shell.
• Never build a command by string interpolation of a tool argument. Use execFile/spawn with an explicit argument vector.
• Validate content, not just type. A Zod z.string() proves the value is a string and nothing about what is in it. Allowlist where the value set is known; reject shell metacharacters where it is not.
• Run the MCP server as an unprivileged user with the narrowest filesystem and network reach the tool actually needs.

NIST SP 800-53r5 SI-10; OWASP ASVS v4 §5.3.8; CWE-78 mitigations M1 and M2.

Timeline

References

• npm package — https://www.npmjs.com/package/@webfer/mcp-ansible-drupal
• Repository — https://github.com/webfer/MCP-Ansible-Drupal
• Precedent for the MCP threat model — CVE-2026-5058 (aws-mcp-server)

Companion advisories from the same research pass: CVE-2026-52616, CVE-2026-52617.

License

MIT — see LICENSE.