# CVE-2025-69256: Serverless Framework MCP Server command injection in list-projects

Source: https://junglewise.ai/threats/cve-2025-69256-serverless-framework-mcp-server-command-injection-in-list  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-69256 · Severity: low · CVSS 3.1 · Published 2025-12-31

The Serverless Framework includes an experimental MCP (Model Context Protocol) server that allows AI assistants to discover and interact with serverless projects. A command injection vulnerability in the list-projects tool allows an attacker to inject arbitrary shell commands by manipulating the workspace path parameter. If the MCP server is exposed to the internet or used with an untrusted AI client, this could lead to complete system compromise and remote code execution.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-69256 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-69256 being exploited in the wild.

**How severe is CVE-2025-69256?** Low severity, with a CVSS score of 3.1, published 31 December 2025.

**Which products and versions are affected?** serverless (npm) SEMVER:introduced=4.29.0,fixed=4.29.3.

**Is there a fix for CVE-2025-69256?** Yes. serverless (npm): upgrade to 4.29.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-69256 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-69256?** Check whether you run serverless (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- serverless (npm): upgrade to 4.29.3 or later

  ```sh
  npm install serverless@4.29.3
  ```


## Technical details

The vulnerability is a command injection flaw in the @serverless/mcp package affecting versions before 4.29.3. The list-projects tool accepts a workspaceRoots parameter that is passed unsanitized to child_process.exec() within the project-finder module's findServerlessFrameworkProjects() function. An attacker can inject shell metacharacters (such as $(command), &&, |, >) to execute arbitrary code. The vulnerability requires user interaction or tool invocation through the MCP protocol, and the attack vector is network-accessible if the MCP server is exposed. Successful exploitation results in remote code execution under the server process's privileges. The fix is to use child_process.execFile() with argument arrays instead of shell string concatenation.

## Affected products

- Serverless Framework <4.29.3

## Identifiers

- CVE-2025-69256
- GHSA-rwc2-f344-q6w6

## Timeline

- 2025-12-31: disclosed
- 2025-12-31: patched: Fixed in version 4.29.3

## References

- [https://github.com/serverless/serverless/security/advisories/GHSA-rwc2-f344-q6w6](https://github.com/serverless/serverless/security/advisories/GHSA-rwc2-f344-q6w6)