CVE-2025-52573 Command Injection in MCP Server ios-simulator-mcp

iOS Simulator MCP Server ios-simulator-mcp is a Model Context Protocol MCP server for interacting with iOS simulators. Versions prior to 1.3.3 are written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. T...

CVE-2025-52573

CVE-2025-52573 affects the iOS Simulator MCP Server (ios-simulator-mcp). The vulnerability arises in the MCP Server’s tool definitions (notably the ui_tap tool) which rely on Node.js child process API exec. When untrusted input is used for parameters such as duration, udid, x, and y, shell meta-c...

CVE-2025-52573 Command Injection in MCP Server ios-simulator-mcp

iOS Simulator MCP Server ios-simulator-mcp is a Model Context Protocol MCP server for interacting with iOS simulators. Versions prior to 1.3.3 are written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. T...

CVE-2025-52573 Command Injection in MCP Server ios-simulator-mcp

iOS Simulator MCP Server ios-simulator-mcp is a Model Context Protocol MCP server for interacting with iOS simulators. Versions prior to 1.3.3 are written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. T...

PT-2025-26970 · Apple · Ios Simulator Mcp Server

Name of the Vulnerable Software and Affected Versions: iOS Simulator MCP Server versions prior to 1.3.3 Description: The issue concerns a command injection vulnerability in the MCP Server tool definition and implementation. The MCP Server exposes the tool ui tap, which relies on the Node.js child...

iOS Simulator MCP Server 操作系统命令注入漏洞

iOS Simulator MCP Server is an MCP server for interacting with iOS Simulator by Joshua Yoes, an individual developer. An operating system command injection vulnerability exists in iOS Simulator MCP Server versions prior to 1.3.3, which stems from a command injection vulnerability in some MCP Serv...

Why a Classic MCP Server Vulnerability Can Undermine Your Entire AI Agent

A single SQL injection bug in Anthropic’s SQLite MCP server—forked over 5,000 times—can seed stored prompts, exfiltrate data, and hand attackers the keys to entire agent workflows. This entry unpacks the attack chain and lays out concrete fixes to shut it down...

@cyanheads/git-mcp-server (>=2.0.10, <=2.1.0), @dsazz/mcp-confluence (0.2.0) +34 more potentially affected by CVE-2025-49596 via @modelcontextprotocol/inspector (>=0.2.7, <=0.13.0)

@modelcontextprotocol/inspector NPM version =0.2.7, =2.0.10, =1.0.1, =0.0.0-alpha.0, =1.0.0, =0.1.0, =0.1.2 and more Source cves: CVE-2025-49596 Source advisory: OSV:GHSA-7F8R-222P-6F5G...

MCP Server Unauthenticated Access

This is an informational notice that the scanner was able to detect a Model Context Protocol MCP server available without authentication on the target server. When available, the plugin provides the list of tools, prompts and resources in the attachments. No source data...

CVE-2025-5277

aws-mcp-server MCP server is vulnerable to command injection. An attacker can craft a prompt that once accessed by the MCP client will run arbitrary commands on the host system...

GHSA-FRQ9-3HP2-XVXG Markdownify MCP Server allows Server-Side Request Forgery (SSRF) via the Markdownify.get() function

All versions of the package mcp-markdownify-server are vulnerable to Server-Side Request Forgery SSRF via the Markdownify.get function. An attacker can craft a prompt that, once accessed by the MCP host, can invoke the webpage-to-markdown, bing-search-to-markdown, and youtube-to-markdown tools to...

Markdownify MCP Server allows Server-Side Request Forgery (SSRF) via the Markdownify.get() function

All versions of the package mcp-markdownify-server are vulnerable to Server-Side Request Forgery SSRF via the Markdownify.get function. An attacker can craft a prompt that, once accessed by the MCP host, can invoke the webpage-to-markdown, bing-search-to-markdown, and youtube-to-markdown tools to...

GHSA-22V8-P7H2-RJ7P Markdownify MCP Server allows attackers to read arbitrary files

All versions of the package mcp-markdownify-server are vulnerable to Files or Directories Accessible to External Parties via the get-markdown-file tool. An attacker can craft a prompt that, once accessed by the MCP host, will allow it to read arbitrary files from the host running the server...

Markdownify MCP Server allows attackers to read arbitrary files

All versions of the package mcp-markdownify-server are vulnerable to Files or Directories Accessible to External Parties via the get-markdown-file tool. An attacker can craft a prompt that, once accessed by the MCP host, will allow it to read arbitrary files from the host running the server...

CVE-2025-5277

aws-mcp-server MCP server is vulnerable to command injection. An attacker can craft a prompt that once accessed by the MCP client will run arbitrary commands on the host system...

CVE-2025-5277

CVE-2025-5277 affects the aws-mcp-server MCP server. The vulnerability is a command injection where an attacker can craft a prompt that, when accessed by the MCP client, will cause arbitrary commands to run on the host. The NVD metrics indicate a CRITICAL impact (CVSSv4.0 9.4; CVSSv3.1 9.6) with ...

CVE-2025-5277

aws-mcp-server MCP server is vulnerable to command injection. An attacker can craft a prompt that once accessed by the MCP client will run arbitrary commands on the host system...

CVE-2025-5277

aws-mcp-server MCP server is vulnerable to command injection. An attacker can craft a prompt that once accessed by the MCP client will run arbitrary commands on the host system...

CVE-2025-5277

aws-mcp-server MCP server is vulnerable to command injection. An attacker can craft a prompt that once accessed by the MCP client will run arbitrary commands on the host system...

PT-2025-23083

Name of the Vulnerable Software and Affected Versions: aws-mcp-server affected versions not specified Description: The issue is related to command injection. An attacker can craft a prompt that, once accessed by the MCP client, will run arbitrary commands on the host system. Recommendations: At t...