Dataverse (codeurali) MCP Server

This server (without client built-ins) exposes a complete data-exfiltration chain: dataverse_download_file_column → dataverse_get_environment_variable ⇒ dataverse_batch_execute. Untrusted input is ingested, private data is read, and it can be sent to an external sink — and at least one leg is a direct schema wire (⇒), where a producer's output drops straight into a free-text parameter of the next tool, so the chain needs little agent cooperation. Static analysis proves the primitive exists, not that a specific run will occur.

Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.

Location: flow dataverse_download_file_column → dataverse_get_environment_variable → dataverse_batch_execute

In the server's implementation (`dist/doctor.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ;import{exec as Pe}from"child_process";import{platform as G}from"process";function Z(s){let e=G==="win32"?`echo|set /p="

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/doctor.js

In the server's implementation (`dist/server.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ;import{exec as Fr}from"child_process";import{platform as Ft}from"process";function Bt(r){let a=Ft==="win32"?`echo|set /

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/server.js

In the server's implementation (`dist/setup-auth.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ";import{exec as B}from"child_process";import{platform as S}from"process";function I(t){let e=S==="win32"?`echo|set /p="

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/setup-auth.js

Tool "dataverse_batch_execute" takes a URL/host parameter "url" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).

Fix: Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.

Location: tool dataverse_batch_execute · inputSchema.properties.url

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/install.js:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ";import{exec as Z}from"child_process";import{platform as A}from"process";import{createCipheriv as O,createDecipheriv as

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/install.js