Crawlemoon MCP Server

Tool "execute_js" appears to run shell commands or evaluate code (parameter "script"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool execute_js

In the server's implementation (`src/core/browser/xray.py:96`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: res = subprocess.run([system_cmd, "xray"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/core/browser/xray.py

In the server's implementation (`src/mcp/server.py:1325`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: benchmark processes to spawn (default: 5)", "default": 5 }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/mcp/server.py

Untrusted-input tools ([check_robots, crawl]) co-exist with external-action tools ([stealth_request, execute_js]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [check_robots, crawl] → sinks [stealth_request, execute_js]

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow check_robots → stealth_request

Tool "check_robots" takes a URL/host parameter "url" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).

Fix: Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.

Location: tool check_robots · inputSchema.properties.url

Tool "stealth_request" takes a URL/host parameter "url" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).

Fix: Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.

Location: tool stealth_request · inputSchema.properties.url

Tool "crawl" takes a URL/host parameter "url" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).

Fix: Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.

Location: tool crawl · inputSchema.properties.url

Tool "execute_js" takes a command-shaped parameter "script" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool execute_js · inputSchema.properties.script

In the server's implementation (`src/core/cache/manager.py:74`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: None return pickle.loads(data) except pickle.UnpicklingError as exc: raise CacheSerializ

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/core/cache/manager.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_js_analyzer.py:23`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: code = """ fetch('https://api.example.com/users') fetch("https://api.example.com/posts") """

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_js_analyzer.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_mcp_server.py:115`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ts = { "code": "fetch('https://api.example.com');", } result = await handle_extract_from_js(argumen

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_mcp_server.py

Tool "execute_js" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool execute_js

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_js_deobfuscator.py:293`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: function a() { eval(atob("Y29uc29sZS5sb2coJ3Rlc3QnKQ==")); return; console.log("dead code");

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_js_deobfuscator.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_js_security.py:34`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: l('1+1')", "new Function('return 1')()", "document.write('xss')", "import('http://ev

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_js_security.py