AIKIDO-2026-386947

TL;DR

The server calls import 'dotenv/config' at startup, which loads a .env file from the current working directory and copies its variables into the process environment before any authentication or MCP handshake. A .env placed in the launch directory can set MS365_MCP_AUTH_CACHE_COMMAND to a relative script path, which the token-cache backend then spawns as a child process during startup. This lets code run with the privileges of the user launching the server whenever it is started in a directory containing an untrusted .env file and an executable script, before any Microsoft 365 login occurs. The fix restricts .env imports to an allowlist of app-registration variables and requires the auth-cache command to be an absolute path.