Zotero (54yyyu) MCP Server

In the server's implementation (`src/zotero_mcp/cli.py:712`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: uv result = subprocess.run(["uv", "tool", "list"], capture_output=True, text=True, timeout=5) if

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/zotero_mcp/cli.py

In the server's implementation (`src/zotero_mcp/pdfannots_helper.py:112`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: itely. result = subprocess.run(cmd, capture_output=True, text=True, check=True, timeout=120) annotations

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/zotero_mcp/pdfannots_helper.py

In the server's implementation (`src/zotero_mcp/setup_helper.py:85`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ss result = subprocess.run( ["find", os.path.expanduser("~"), "-name", "zotero-mcp", "-type"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/zotero_mcp/setup_helper.py

In the server's implementation (`src/zotero_mcp/tools/write.py:4074`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: (#431). proc = subprocess.Popen( [sys.executable, "-c", _TOC_CHILD_SCRIPT, str(pdf_path)],

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/zotero_mcp/tools/write.py

In the server's implementation (`src/zotero_mcp/updater.py:32`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: result = subprocess.run( ["uv", "tool", "list"], capture_output=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/zotero_mcp/updater.py

In the server's implementation (`src/zotero_mcp/tools/_helpers.py:1663`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ry: conv_resp = requests.get( "https://pmc.ncbi.nlm.nih.gov/tools/idconv/api/v1/articles/",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/zotero_mcp/tools/_helpers.py

In the server's implementation (`src/zotero_mcp/updater.py:155`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: response = requests.get( "https://pypi.org/pypi/zotero-mcp-server/json", timeout=10

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/zotero_mcp/updater.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_description_tokens.py:102`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: desc_val = eval(desc_text, {"__builtins__": {}}, {}) except Exception: desc_val

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_description_tokens.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_context_cost_claim.py:36`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: r. """ result = subprocess.run( [sys.executable, str(GENERATOR), "--json"], capture_output=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_context_cost_claim.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_generic_batch_flags.py:128`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: subprocess return subprocess.run( [sys.executable, "-m", "zotero_mcp.cli", *args], capture_output=

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_generic_batch_flags.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_issue_455_toc_stdout_pollution.py:48`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: , env=None): return subprocess.run( [sys.executable, "-c", _TOC_CHILD_SCRIPT, str(pdf_path)], captur

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_issue_455_toc_stdout_pollution.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_lifespan.py:103`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ist_ok=True) proc = subprocess.run( [sys.executable, "-c", _IMPORT_PROBE, str(home), "__none__" if

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_lifespan.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_lightweight_imports.py:36`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: )\n" ) result = subprocess.run( [sys.executable, "-c", code], capture_output=True, text=

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_lightweight_imports.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/live/test_batch_live.py:112`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: api_key") module = __import__(f"zotero_mcp.{provider}_batch", fromlist=["_"]) adapter = module.ADAPTER mode

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/live/test_batch_live.py