Aethereum MCP Server

In the server's implementation (`dist/sdk-5FRGHEGL.js:3042`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ss(V, $); let N = Function(`${y0.default.self}`, `${y0.default.scope}`, V)(this, this.scope.get()); if (this

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/sdk-5FRGHEGL.js

In the server's implementation (`dist/chunk-3MMBQP4F.js:20`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: FileSync, spawn } from "child_process"; function sanitizeSessionName(name) { return name.replace(/[.:$%]/g, "_"); } va

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/chunk-3MMBQP4F.js

In the server's implementation (`dist/chunk-BFVTAROS.js:48`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFileSync } from "child_process"; import { join as join3, resolve, basename } from "path"; import { homedir as hom

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/chunk-BFVTAROS.js

In the server's implementation (`dist/chunk-VJZJ4SQY.js:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFileSync } from "child_process"; import { realpathSync } from "fs"; import { dirname, join, relative, resolve } f

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/chunk-VJZJ4SQY.js

In the server's implementation (`dist/chunk-WFJLCKOP.js:6`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; import { readFileSync, writeFileSync, mkdirSync } from "fs"; import { homedir }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/chunk-WFJLCKOP.js

In the server's implementation (`dist/cli/index.js:195`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: n, execFileSync } from "child_process"; import { randomUUID } from "crypto"; import { createRequire } from "module"; imp

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/index.js

In the server's implementation (`dist/sdk-5FRGHEGL.js:5`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: execFile as E6$ } from "child_process"; import { randomUUID as rz } from "crypto"; import { createReadStream as b6$, rea

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/sdk-5FRGHEGL.js

In the server's implementation (`dist/share-terminal-77YJXHBO.js:22`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFileSync } from "child_process"; import { appendFileSync, mkdirSync } from "fs"; import { join } from "path"; imp

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/share-terminal-77YJXHBO.js

Untrusted-input tools ([aethereum__fetch_code, aethereum__list_code]) co-exist with external-action tools ([send_message, aethereum__send_message]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [aethereum__fetch_code, aethereum__list_code] → sinks [send_message, aethereum__send_message]

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow aethereum__fetch_code → send_message