Hardening stdio MCP servers against command injection

An advisory (GHSA-7w94-79vh-5mr2) describes how an MCP server API accepted user-supplied command, args and env fields and passed them into a shell wrapper, letting a request execute arbitrary code. The vulnerable pattern was reduced to a minimal demo showing that shell substitution still runs before exec and that environment fields can hijack binary resolution. The author argues the real flaw is that users define what runs, so parsing fixes alone are insufficient. The proposed fix maps only approved server IDs to pinned argv lists, disables the shell, and builds the child environment from an allowlist. A companion code repository includes an audit script and fleet policy examples to help teams check and lock down their machines.