@toolsdk.ai/registry (1.0.83) potentially affected by CVE-2025-53355 +1 more via mcp-server-kubernetes (2.4.3)

mcp-server-kubernetes NPM version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on mcp-server-kubernetes and may be impacted: - @toolsdk.ai/registry 1.0.83 Source cves: CVE-2025-53355, CVE-2025-54073 Source advisory: OSV:GHSA-GJV4-GHM7-Q58Q...

CVE-2025-53355 mcp-server-kubernetes vulnerable to command injection in several tools

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. A command injection vulnerability exists in the mcp-server-kubernetes MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.execSync, enabling ...