Upsonic MCP Command Allowlist Bypass RCE (CVE-2026-30625) - ATR-2026-00542 (c2cd11fd-3e59-523a-9abf-243e2540a2da)
Detects CVE-2026-30625 (CVSS HIGH, CWE-77): Upsonic passes the command field from MCP server configuration directly to subprocess execution. The framework maintains a nominal allowlist of safe launchers (npx, uvx, python -m) but does not enforce it at the subprocess call site, allowing an attacker who controls MCP server configuration to supply a shell binary or interpreter with inline-exec flags as the command value.
The root cause is identical to CVE-2026-30624 (Agent Zero) and the class documented in OX Security's "MCP by design" advisory (April 2026): subprocess spawning without server-side allowlist enforcement.
Upsonic uses a Python dict / JSON-style config with a top-level 'mcp_servers' key; server objects contain 'command' and 'args' fields that are passed to subprocess or anyio.open_process without validation.
Detection covers: (a) Upsonic MCP config with shell binary or network tool in command field; (b) Upsonic config with interpreter + inline-exec flag (-c/-e) in args; (c) Explicit CVE-2026-30625 / Upsonic MCP exploitation framing.