AIKIDO-2026-386947

@softeria/ms-365-mcp-server is vulnerable to Code Injection

Code InjectionGHSA-9w34-3f56-vwmh Published Aug 12, 2026

High Risk

This Affects:

@softeria/ms-365-mcp-server

0.111.0 - 0.136.0

Fixed in 0.137.0

Are you affected? Scan for Free

TL;DR

The server calls import 'dotenv/config' at startup, which loads a .env file from the current working directory and copies its variables into the process environment before any authentication or MCP handshake. A .env placed in the launch directory can set MS365_MCP_AUTH_CACHE_COMMAND to a relative script path, which the token-cache backend then spawns as a child process during startup. This lets code run with the privileges of the user launching the server whenever it is started in a directory containing an untrusted .env file and an executable script, before any Microsoft 365 login occurs. The fix restricts .env imports to an allowlist of app-registration variables and requires the auth-cache command to be an absolute path.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you launch the server in the default stdio mode from a directory that may contain an untrusted .env file and script.