Junglewise Threat Intelligence

CVE-2025-54994: akoskm create-mcp-server-stdio command injection in which-app-on-port

CVE-2025-54994 · Severity: medium · CVSS 4 · Published 2025-09-08

Vendors: npm.

Executive brief

The @akoskm/create-mcp-server-stdio package, a starter kit for building Model Context Protocol (MCP) servers, is vulnerable to command injection. This flaw allows an attacker to execute arbitrary system commands on the host machine by providing malicious input to the 'which-app-on-port' tool. In practice, this could lead to full system compromise, unauthorized data access, or service disruption, especially if the server is triggered by an AI model processing untrusted prompts.

Technical details

The vulnerability exists in the 'which-app-on-port' tool implementation within the MCP server. The code uses the Node.js child_process.exec() function to run shell commands (lsof and ps) by concatenating them with user-supplied port numbers without proper sanitization. An attacker can exploit this by injecting shell metacharacters (e.g., semicolons or pipes) into the port parameter. This is particularly dangerous in MCP environments where Large Language Models (LLMs) might be manipulated via prompt injection to call this tool with malicious payloads. The issue was resolved in version 0.0.13 by migrating from exec() to execFile(), which handles arguments more securely.

Affected products

  • akoskm @akoskm/create-mcp-server-stdio <= 0.0.13

Timeline

  • 2025-07-12: disclosed: Vulnerability reported and fix proposed via pull request.
  • 2025-07-14: patched: Fix merged into main branch.
  • 2025-09-08: advisory: GitHub Security Advisory published.

References