Skip to content

Instantly share code, notes, and snippets.

@alon710

alon710/CVE-2025-69256.md

Created January 24, 2026 22:44
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save alon710/1b374eaf78dadda1b4eab4b9c4ec88f1 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save alon710/1b374eaf78dadda1b4eab4b9c4ec88f1 to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2025-69256: Serverless Command Injection: When 'Experimental' Means 'Remote Shell' - CVE Security Report
Raw
CVE-2025-69256.md

CVE-2025-69256: Serverless Command Injection: When 'Experimental' Means 'Remote Shell'

CVSS Score: 7.5 Published: 2025-12-31 Full Report: https://cvereports.com/reports/CVE-2025-69256

Summary

The Serverless Framework's experimental Model Context Protocol (MCP) server contained a critical command injection vulnerability. By failing to sanitize directory paths passed to a shell command, the tool allowed attackers—or confused LLMs—to execute arbitrary system commands.

TL;DR

A classic OS Command Injection vulnerability in the Serverless Framework's MCP server (@serverless/mcp). The list-projects tool passed unvalidated user input directly into a find command spawned via child_process.exec. This allowed Remote Code Execution (RCE) on the developer's machine. Fixed in version 4.29.3 by switching to execFile and implementing path validation.

Exploit Status: POC

Technical Details

  • CWE ID: CWE-78 (OS Command Injection)
  • CVSS Score: 7.5 (High)
  • Attack Vector: Network / Local (via MCP Interface)
  • Impact: High (Confidentiality, Integrity, Availability)
  • Component: @serverless/mcp
  • Vulnerable Function: findServerlessFrameworkProjects (via child_process.exec)

Affected Systems

  • Serverless Framework CLI (Experimental MCP Server)
  • Serverless Framework (MCP): 4.29.0 - 4.29.2 (Fixed in: 4.29.3)

Mitigation

  • Input Sanitization: Validate all directory paths against an allowlist or verify existence before usage.
  • Avoid Shells: Use execFile or spawn instead of exec to prevent shell interpreter abuse.
  • Principle of Least Privilege: Ensure development tools run with the minimum necessary permissions.

Remediation Steps:

  1. Upgrade Serverless Framework to version 4.29.3 or later.
  2. If upgrading is not possible, disable the MCP server component.
  3. Audit any usage of serverless mcp for unusual process execution logs.

References

Generated by CVEReports - Automated Vulnerability Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment