awesome-ionic-mcp

The server uses `execa` to run Ionic and Capacitor CLI commands. While it attempts to validate commands and arguments with a `dangerousChars` regex to prevent shell injection, there's a critical vulnerability in the `validateCommand` function. It implicitly allows `npx` to execute *any* package name that starts with 'cap' (e.g., `npx cap-malicious-package`), even if it's not `@capacitor/cli`, if not explicitly whitelisted. This could lead to arbitrary code execution if an attacker can control the package name passed to a CLI tool that uses `npx`. Additionally, Puppeteer is launched with `--no-sandbox` and `--disable-setuid-sandbox` flags, which disables Chromium's security sandbox, posing a risk if a browser vulnerability is exploited.