Junglewise Threat Intelligence

CVE-2025-53372: node-code-sandbox-mcp command injection in sandbox escape

CVE-2025-53372 · Severity: low · CVSS 3.1 · Published 2025-07-08

Vendors: npm.

Executive brief

The Node.js Sandbox MCP Server is a utility that allows code execution within isolated Docker containers. A command injection vulnerability in the sandbox termination feature allows attackers to execute arbitrary system commands on the host machine, bypassing the intended isolation and gaining control over the underlying system.

Technical details

The vulnerability is a classic OS command injection (CWE-77) caused by passing unsanitized user input directly into shell command strings via child_process.execSync. Specifically, the stopSandbox function in stop.ts concatenates user-supplied container_id directly into a docker rm command template without validation. An attacker can inject shell metacharacters (|, &, >, etc.) to execute arbitrary commands. The attack vector is network-adjacent, requiring an MCP client connection but no special privileges. Exploitation can be triggered indirectly through prompt injection attacks—for example, by embedding malicious payloads in file contents that cause an LLM-powered MCP client to generate code that calls sandbox_stop with a crafted container_id. The fix, available in version 1.3.0 and later, replaces execSync with execFileSync, which accepts arguments as an array rather than interpreting shell syntax.

Affected products

  • Alfonso Graziano node-code-sandbox-mcp <=1.2.0

Timeline

  • 2025-07-08: disclosed: Vulnerability published as GHSA-5w57-2ccq-8w95 and CVE-2025-53372
  • 2025-07-04: patched: Fixes committed to address command injection (commits af860e2, a5e05fa, e461a74) prior to advisory publication
  • 2025-02-04: other: Advisory modified in OSV database

References