Skip to content

Additional Improvements to MCP Server Config security#5943

Open
christopherholland-workday wants to merge 1 commit intomainfrom
mcp-flags
Open

Additional Improvements to MCP Server Config security#5943
christopherholland-workday wants to merge 1 commit intomainfrom
mcp-flags

Conversation

@christopherholland-workday
Copy link
Contributor

FLOWISE-296

@FlowiseAI FlowiseAI deleted a comment from gemini-code-assist bot Mar 10, 2026
@christopherholland-workday christopherholland-workday marked this pull request as ready for review March 10, 2026 18:35
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

The pull request enhances the security of the MCP (Malicious Command Protection) tool by adding more flags and subcommands to the blocklists for npx, node, and docker commands, preventing arbitrary code execution, privilege escalation, and local file access vulnerabilities. Specifically, the changes include blocking --yes and --node-options for npx, -r, --require, --loader, --experimental-loader, --import, and --env-file for node, and build, compose, --mount, --volumes-from, --device, --entrypoint, and --env-file for docker. Additionally, the regex for Unix absolute paths was updated to correctly identify paths starting with double slashes, preventing path traversal vulnerabilities. New test cases were added to validate these security enhancements.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants