{"cve":"CVE-2026-55157","nvd":{"published":"2026-09-28T18:17:23.373","modified":"2026-10-01T15:17:30.207","status":"Deferred","description":"Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smart_user tool. Any MCP client that can call the smart_user tool can execute arbitrary shell commands through the username argument of the get-user-info operation. The commands execute with the privileges of the user running the token-optimizer-mcp server. This issue has been patched in version 5.1.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.4},"cwes":["CWE-78"],"references":["https://github.com/ooples/token-optimizer-mcp/commit/b4ee96dac799cbfba0a9f9c17844ce9d613cbcc7","https://github.com/ooples/token-optimizer-mcp/releases/tag/v5.1.0","https://github.com/ooples/token-optimizer-mcp/security/advisories/GHSA-49mq-fc6q-3h46","https://github.com/ooples/token-optimizer-mcp/security/advisories/GHSA-49mq-fc6q-3h46"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:48.555445741+00:00"},"epss":{"cve":"CVE-2026-55157","score":0.00881,"percentile":0.58858,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-49mq-fc6q-3h46","url":"https://osv.dev/vulnerability/GHSA-49mq-fc6q-3h46","summary":"Token Optimizer MCP: OS command injection in smart_user via username in get-user-info","modified":"2026-08-14T21:56:05.559576Z","packages":[{"ecosystem":"npm","name":"@ooples/token-optimizer-mcp","purl":"pkg:npm/%40ooples/token-optimizer-mcp","ranges":["<5.1.0"],"fixed":["5.1.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}