VYPR
Get started
← All advisories
Critical severityOSV Advisory· Published Sep 8, 2025· Updated Apr 15, 2026

CVE-2025-54994

CVE-2025-54994

Description

@akoskm/create-mcp-server-stdio is an MCP server starter kit that uses the StdioServerTransport. Prior to version 0.0.13, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. The MCP Server exposes the tool which-app-on-port which relies on Node.js child process API exec which is an unsafe and vulnerable API if concatenated with untrusted user input. Version 0.0.13 contains a fix for the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@akoskm/create-mcp-server-stdionpm
< 0.0.130.0.13

Affected products

1

Patches

1
48c26bbe1f8c

fix: apply secure coding convention with execFile to prevent command injection in MCP server code (#1)

https://github.com/akoskm/create-mcp-server-stdioLiran TalJul 14, 2025via ghsa
commit
1 file changed · +3 −3
  • src/index.ts+3 −3 modified
    @@ -1,7 +1,7 @@
 import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { exec } from "child_process";
+import { execFile } from "child_process";
 // Create an MCP server
 const server = new McpServer({
   name: "Demo",
@@ -23,13 +23,13 @@ interface ProcessInfo {
 
 server.tool("which-app-on-port", { port: z.number() }, async ({ port }) => {
   const result = await new Promise<ProcessInfo>((resolve, reject) => {
-    exec(`lsof -t -i tcp:${port}`, (error, pidStdout) => {
+    execFile('lsof', ['-t', '-i', `tcp:${port}`], (error, pidStdout) => {
       if (error) {
         reject(error);
         return;
       }
       const pid = pidStdout.trim();
-      exec(`ps -p ${pid} -o comm=`, (error, stdout) => {
+      execFile('ps', ['-o', 'comm=', '-p', pid], (error, stdout) => {
         if (error) {
           reject(error);
           return;

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.