The explicit link command constructs a shell command from persisted, user-supplied configuration. Unescaped siteUrl and apiKey values permit shell injection when link is run.
Static reason
No blocking static signals were detected.
Trigger
User runs mcphosting-cli link after login or using a crafted ~/.mcphosting.json.
Impact
Arbitrary commands can run with the invoking user's privileges; the command also configures Claude Code to use the selected MCP server.
Mechanism
Shell command injection through execSync string interpolation.
Rationale
Source inspection confirms a command-injection vulnerability in the explicit link workflow, but no lifecycle-based or stealthy malicious behavior. Warn rather than block.
Evidence
package.jsonindex.jsREADME.md~/.mcphosting.json
Network endpoints2
mcphosting.com<user-configured siteUrl>/api/mcp/mcp