CVE-2025-6514 OS command injection in mcp-remote when connecting to untrusted MCP servers

mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorizationendpoint response URL...

mcp-remote 操作系统命令注入漏洞

mcp-remote is an MCP linking software by the individual developer Glen Maddern. An operating system command injection vulnerability exists in mcp-remote, which stems from the presence of OS command injection when connecting to an untrusted MCP server...

GHSA-GJV4-GHM7-Q58Q MCP Server Kubernetes vulnerable to command injection in several tools

Summary A command injection vulnerability exists in the mcp-server-kubernetes MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.execSync, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to...

MCP Server Kubernetes vulnerable to command injection in several tools

Summary A command injection vulnerability exists in the mcp-server-kubernetes MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.execSync, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to...

CVE-2025-53355

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. A command injection vulnerability exists in the mcp-server-kubernetes MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.execSync, enabling ...

CVE-2025-53355 mcp-server-kubernetes vulnerable to command injection in several tools

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. A command injection vulnerability exists in the mcp-server-kubernetes MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.execSync, enabling ...

CVE-2025-53355 mcp-server-kubernetes vulnerable to command injection in several tools

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. A command injection vulnerability exists in the mcp-server-kubernetes MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.execSync, enabling ...

CVE-2025-53355

CVE-2025-53355 – Mode C summary The vulnerability affects the mcp-server-kubernetes component of MCP Server. The root cause is unsanitized input being interpolated into shell commands via a call to shell-based child_process.execSync, enabling an attacker to inject arbitrary commands and potential...

CVE-2025-53355 mcp-server-kubernetes vulnerable to command injection in several tools

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. A command injection vulnerability exists in the mcp-server-kubernetes MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.execSync, enabling ...

CVE-2025-53372

node-code-sandbox-mcp is a Node.js–based Model Context Protocol server that spins up disposable Docker containers to execute arbitrary JavaScript. Prior to 1.3.0, a command injection vulnerability exists in the node-code-sandbox-mcp MCP Server. The vulnerability is caused by the unsanitized use o...

CVE-2025-53372 node-code-sandbox-mcp has a Sandbox Escape via Command Injection

node-code-sandbox-mcp is a Node.js–based Model Context Protocol server that spins up disposable Docker containers to execute arbitrary JavaScript. Prior to 1.3.0, a command injection vulnerability exists in the node-code-sandbox-mcp MCP Server. The vulnerability is caused by the unsanitized use o...

CVE-2025-53372 node-code-sandbox-mcp has a Sandbox Escape via Command Injection

node-code-sandbox-mcp is a Node.js–based Model Context Protocol server that spins up disposable Docker containers to execute arbitrary JavaScript. Prior to 1.3.0, a command injection vulnerability exists in the node-code-sandbox-mcp MCP Server. The vulnerability is caused by the unsanitized use o...

CVE-2025-53372 node-code-sandbox-mcp has a Sandbox Escape via Command Injection

node-code-sandbox-mcp is a Node.js–based Model Context Protocol server that spins up disposable Docker containers to execute arbitrary JavaScript. Prior to 1.3.0, a command injection vulnerability exists in the node-code-sandbox-mcp MCP Server. The vulnerability is caused by the unsanitized use o...

Node.js Sandbox MCP Server 安全漏洞

Node.js Sandbox MCP Server is a context protocol server based on the Node.js model by the individual developer Alfonso Graziano. A security vulnerability exists in Node.js Sandbox MCP Server versions prior to 1.3.0 that stems from command injection and could lead to remote code execution...

PT-2025-28473 · Unknown · Node-Code-Sandbox-Mcp

Name of the Vulnerable Software and Affected Versions: node-code-sandbox-mcp versions prior to 1.3.0 Description: The issue is caused by the unsanitized use of input parameters within a call to child process.execSync, enabling an attacker to inject arbitrary system commands. Successful exploitati...

PT-2025-28662 · Unknown · Mcp-Server-Kubernetes

Name of the Vulnerable Software and Affected Versions: MCP Server Kubernetes versions prior to 2.5.0 Description: MCP Server Kubernetes is vulnerable to a command injection issue due to the unsanitized use of input parameters within a call to child process.execSync. This allows an attacker to...

CVE-2025-53366

A flaw was found in MCP. The MCP Python SDK contains a validation error that leads to an unhandled exception when processing malformed requests. This flaw allows a remote attacker to trigger this condition by sending a crafted request, resulting in an application-level service interruption...

CVE-2025-53365

A flaw was found in MCP. The mcp Python SDK exhibits an uncaught exception when a client intentionally triggers an error following the establishment of a streamable HTTP session. This condition allows a remote attacker to cause a program crash. The vulnerability stems from a lack of exception...

MAL-2025-5813 Malicious code in glean-mcp-server (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2116bc0a7e97b50629b8572a3e7b46cb436c7732be15b4aa9c87835444eff955 Any computer that has this package installed or running should be considered...

Malicious code in glean-mcp-server (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2116bc0a7e97b50629b8572a3e7b46cb436c7732be15b4aa9c87835444eff955 Any computer that has this package installed or running should be considered...