813 matches found
CVE-2025-54994
@akoskm/create-mcp-server-stdio is an MCP server starter kit that uses the StdioServerTransport. Prior to version 0.0.13, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. The MCP...
Command Injection
Overview @akoskm/create-mcp-server-stdio is a MCP Server Starter kit using the StdioServerTransport Affected versions of this package are vulnerable to Command Injection via the which-app-on-port tool, which executes exec on user input. An attacker can execute arbitrary commands on the host syste...
CVE-2025-54994
CVE-2025-54994 affects the MCP Server Starter kit @akoskm/create-mcp-server-stdio. The vulnerable component is the which-app-on-port tool that uses Node.js child_process.exec, exposing command-injection risk when user input is unsafely concatenated into shell commands. Affected versions precede 0...
CVE-2025-54994 @akoskm/create-mcp-server-stdio has Command Injection in MCP Server due to unsafe `exec` API
@akoskm/create-mcp-server-stdio is an MCP server starter kit that uses the StdioServerTransport. Prior to version 0.0.13, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. The MCP...
Malicious code in cloudflare-agent-starter (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 073c16b7f6f9d6ba8d94458e7efa756a07cfcc78cefbda3ed218097358812980 The OpenSSF Package Analysis project identified 'cloudflare-agent-starter' @ 99.99.99 npm as malicious. It is considered malicious because: - Th...
MAL-2025-6880 Malicious code in cloudflare-agent-starter (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 073c16b7f6f9d6ba8d94458e7efa756a07cfcc78cefbda3ed218097358812980 The OpenSSF Package Analysis project identified 'cloudflare-agent-starter' @ 99.99.99 npm as malicious. It is considered malicious because: - Th...
Malicious code in go-api-starter (npm)
The package go-api-starter was found to contain malicious code...
Malicious code in redux-starter (npm)
The package redux-starter was found to contain malicious code...
Malicious code in fusion-starter (npm)
The package fusion-starter was found to contain malicious code...
Malicious code in fusion-starter-build-scripts (npm)
The package fusion-starter-build-scripts was found to contain malicious code...
MAL-2025-21618 Malicious code in go-api-starter (npm)
The package go-api-starter was found to contain malicious code...
MAL-2025-24454 Malicious code in kik-starter (npm)
The package kik-starter was found to contain malicious code...
Malicious code in atom-shell-starter (npm)
The package atom-shell-starter was found to contain malicious code...
Malicious code in mns-fe-starter-kit (npm)
The package mns-fe-starter-kit was found to contain malicious code...
Malicious code in kik-starter (npm)
The package kik-starter was found to contain malicious code...
Malicious code in zooplus-react-starter (npm)
The package zooplus-react-starter was found to contain malicious code...
MAL-2025-21078 Malicious code in fusion-starter (npm)
The package fusion-starter was found to contain malicious code...
MAL-2025-41063 Malicious code in zooplus-react-starter (npm)
The package zooplus-react-starter was found to contain malicious code...