Quick answers
- Is CVE-2025-69256 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-69256 being exploited in the wild.
- How severe is CVE-2025-69256?
- Low severity, with a CVSS score of 3.1, published 31 December 2025.
- Which products and versions are affected?
- serverless (npm) SEMVER:introduced=4.29.0,fixed=4.29.3.
- Is there a fix for CVE-2025-69256?
- Yes. serverless (npm): upgrade to 4.29.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-69256 attacked?
- It is attacked over the network.
- Am I affected by CVE-2025-69256?
- Check whether you run serverless (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- serverless (npm): upgrade to 4.29.3 or later
npm install serverless@4.29.3
Technical details
The vulnerability is a command injection flaw in the @serverless/mcp package affecting versions before 4.29.3. The list-projects tool accepts a workspaceRoots parameter that is passed unsanitized to child_process.exec() within the project-finder module's findServerlessFrameworkProjects() function. An attacker can inject shell metacharacters (such as $(command), &&, |, >) to execute arbitrary code. The vulnerability requires user interaction or tool invocation through the MCP protocol, and the attack vector is network-accessible if the MCP server is exposed. Successful exploitation results in remote code execution under the server process's privileges. The fix is to use child_process.execFile() with argument arrays instead of shell string concatenation.
Affected products
- Serverless Framework <4.29.3
Identifiers
- CVE-2025-69256
- GHSA-rwc2-f344-q6w6
Timeline
- 2025-12-31: disclosed
- 2025-12-31: patched: Fixed in version 4.29.3