Curation review for GHSA-gvwf-5g64-3vvw: global publication and possible duplicate

リポジトリのアドバイザリ GHSA-gvwf-5g64-3vv と GHSA-88qq-fvcm-92qq、およびリンクされている CVE/GHSA レコードと 1.1.3 の修正範囲を確認してください。残存する AWK スクリプトファイルの挙動を重複するアドバイザリと比較し、このレコードを個別に昇格するべきか、統合するべきかを判断してください。完了条件は、キュレーションの判断と、必要な canonical-advisory または撤回の対応を文書化することです。

Summary

I maintain tumf/mcp-shell-server. Repository advisory GHSA-gvwf-5g64-3vvw was published on 2026-08-02 but is still absent from the global GitHub Advisory Database and OSV.

I have revalidated and corrected the repository advisory against the released versions. I am requesting curation review before requesting a CVE because the remaining vulnerability may overlap another published repository advisory.

Advisory

• Repository advisory: https://github.com/tumf/mcp-shell-server/security/advisories/GHSA-gvwf-5g64-3vvw
• Package: mcp-shell-server (pip)
• Affected versions: <= 1.1.2
• Patched version: 1.1.3
• Remaining scoped behavior: when awk is allowlisted, awk -f /dev/stdin accepts an attacker-controlled AWK program through the MCP tool's stdin, allowing external command execution as the server process user
• CWE: CWE-78, CWE-184
• Severity currently recorded: High

Scope correction already made

The original report reviewed an older commit and combined tar, git, and AWK vectors. Release-level revalidation found:

• the reported tar vector was already rejected in 1.1.1 and 1.1.2;
• the reported git vector was already rejected in 1.1.1 and 1.1.2 and overlaps CVE-2026-85735 / GHSA-56qh-7rgp-wfgr;
• whitespace-obfuscated awk system() was already rejected before 1.1.2;
• awk -f /dev/stdin remained accepted in 1.1.1 and 1.1.2 and is rejected in 1.1.3.

The repository advisory has been edited to reflect only the remaining release-level AWK script-file/stdin vulnerability while preserving reporter credit.

Possible overlap

The same 1.1.3 remediation commit also addressed behavior reported in:

• https://github.com/tumf/mcp-shell-server/security/advisories/GHSA-88qq-fvcm-92qq

That advisory covers sed command execution, GNU find file output, and AWK external file/script access. Both advisories identify 1.1.3 as the patched release, and both include AWK script-file handling.

Request

Could the curation team determine whether:

1. GHSA-gvwf-5g64-3vvw should be promoted as a separate global advisory; or
2. it should be treated as a duplicate of or consolidated with GHSA-88qq-fvcm-92qq?

I am intentionally holding the Request CVE action until the duplication/counting question is resolved. If the advisories should be consolidated, please advise which repository advisory should remain canonical and whether GitHub Support must withdraw the duplicate.