> in pure Bash.
Not really in "pure bash". Also this needs to be labeled as a "toy".
Using an external tool like 'jq' especially written in C for parsing JSON, one can craft a exploitable JSON input to achieve code execution on the MCP server.
What could possibly go wrong? Maybe this CVE-2025-48060 [0] [1]?