Executive brief
The Serverless Framework includes an experimental MCP (Model Context Protocol) server that allows AI assistants to discover and interact with serverless projects. A command injection vulnerability in the list-projects tool allows an attacker to inject arbitrary shell commands by manipulating the workspace path parameter. If the MCP server is exposed to the internet or used with an untrusted AI client, this could lead to complete system compromise and remote code execution.
Technical details
The vulnerability is a command injection flaw in the @serverless/mcp package affecting versions before 4.29.3. The list-projects tool accepts a workspaceRoots parameter that is passed unsanitized to child_process.exec() within the project-finder module's findServerlessFrameworkProjects() function. An attacker can inject shell metacharacters (such as $(command), &&, |, >) to execute arbitrary code. The vulnerability requires user interaction or tool invocation through the MCP protocol, and the attack vector is network-accessible if the MCP server is exposed. Successful exploitation results in remote code execution under the server process's privileges. The fix is to use child_process.execFile() with argument arrays instead of shell string concatenation.
Affected products
- Serverless Framework <4.29.3
Timeline
- 2025-12-31: disclosed
- 2025-12-31: patched: Fixed in version 4.29.3