CVE-2026-55157: Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

token-optimizer-mcp is vulnerable to OS command injection in the smart_user tool.

The get-user-info operation accepts a user-controlled username argument and later interpolates it into a shell command executed through execAsync():

getent passwd "${username}" || grep "^${username}:" /etc/passwd

Although the value is wrapped in double quotes, POSIX shells still evaluate command substitution such as $(...) and backticks inside double quotes. As a result, an MCP client can provide a crafted username such as:

$(id > /tmp/TOKEN_OPTIMIZER_SMART_USER_ID)

and execute arbitrary local commands with the privileges of the user running the MCP server.

This is a CWE-78 OS command injection issue.

Tested version:

@ooples/token-optimizer-mcp v5.0.1
MCP serverInfo.name: token-optimizer-mcp
MCP serverInfo.version: 0.2.0

This issue is not related to the current npm audit dependency advisories. The vulnerability is in token-optimizer-mcp’s own tool implementation.