CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-69256

Serverless Command Injection: When 'Experimental' Means 'Remote Shell'

Alon Barad
Alon Barad
Software Engineer

Jan 1, 2026·4 min read·67 visits

Executive Summary (TL;DR)

A classic OS Command Injection vulnerability in the Serverless Framework's MCP server (`@serverless/mcp`). The `list-projects` tool passed unvalidated user input directly into a `find` command spawned via `child_process.exec`. This allowed Remote Code Execution (RCE) on the developer's machine. Fixed in version 4.29.3 by switching to `execFile` and implementing path validation.

The Serverless Framework's experimental Model Context Protocol (MCP) server contained a critical command injection vulnerability. By failing to sanitize directory paths passed to a shell command, the tool allowed attackers—or confused LLMs—to execute arbitrary system commands.

Official Patches

ServerlessRelease notes for version 4.29.3 containing the fix.

Fix Analysis (1)

Technical Appendix

CVSS Score
7.5/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Probability
0.04%
Top 99% most exploited

Affected Systems

Serverless Framework CLI (Experimental MCP Server)

Affected Versions Detail

Product
Affected Versions
Fixed Version
Serverless Framework (MCP)
Serverless, Inc.
4.29.0 - 4.29.24.29.3
AttributeDetail
CWE IDCWE-78 (OS Command Injection)
CVSS Score7.5 (High)
Attack VectorNetwork / Local (via MCP Interface)
ImpactHigh (Confidentiality, Integrity, Availability)
Component@serverless/mcp
Vulnerable FunctionfindServerlessFrameworkProjects (via child_process.exec)

MITRE ATT&CK Mapping

T1059Command and Scripting Interpreter
Execution
T1204User Execution
Execution
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Known Exploits & Detection

GitHub AdvisoryProof of concept demonstrating directory traversal and command execution.

Vulnerability Timeline

Vulnerability identified and patch committed (681ca03)
2025-02-17
Serverless Framework v4.29.3 released
2025-02-19
Advisory GHSA-rwc2-f344-q6w6 published
2025-02-20

References & Sources

  • [1]GitHub Advisory: Command Injection in @serverless/mcp
  • [2]Node.js Documentation: child_process.exec Security Risks

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•14 minutes ago•CVE-2026-107727
3.7

CVE-2026-107727: Connection-Level Denial of Service via State Leak in Strawberry GraphQL Legacy WS Handler

An uncontrolled resource consumption vulnerability in Strawberry GraphQL allows unauthenticated remote attackers to trigger a Denial of Service on persistent WebSocket connections using the legacy graphql-ws protocol. When the server enforces max_subscriptions_per_connection, naturally terminating subscriptions are not cleared from memory registries, leading to exhaustion of connection slots.

Alon Barad
Alon Barad
0 views•6 min read
•about 1 hour ago•CVE-2026-107723
8.1

CVE-2026-107723: Silent Claim-Validator Bypass in NearForm fast-jwt via Array Payload Type Confusion

A high-severity type-confusion vulnerability exists in NearForm fast-jwt prior to version 6.3.0. The vulnerability allows attackers to bypass crucial claim validation steps (such as expiration, issuer, audience, and subject validations) by presenting a validly signed JSON Web Token structured as a JSON array instead of a JSON object. This occurs because the library's decoder fails to reject JSON arrays during type evaluation.

Alon Barad
Alon Barad
5 views•6 min read
•about 2 hours ago•CVE-2026-107721
5.9

CVE-2026-107721: Time Validation Bypass in NearForm fast-jwt due to Loose Temporal Option Validation

NearForm fast-jwt prior to version 6.3.0 is vulnerable to an input validation flaw where configuring verifier properties (such as clockTolerance, clockTimestamp, and cacheTTL) with non-finite values like Infinity or NaN allows attackers to bypass temporal claim validations, including expiration (exp) and activation (nbf) boundaries. This validation bypass can result in unauthorized session persistence and cache poisoning.

Amit Schendel
Amit Schendel
5 views•6 min read
•about 3 hours ago•CVE-2026-107722
9.8

CVE-2026-107722: Algorithm Confusion via Non-Whitespace Prefix Bypass in fast-jwt

A critical cryptographic vulnerability in fast-jwt versions 6.2.x prior to 6.3.0 allows unauthenticated remote attackers to execute an asymmetric-to-symmetric algorithm confusion attack due to incomplete validation of leading non-whitespace prefixes.

Amit Schendel
Amit Schendel
4 views•5 min read
•about 4 hours ago•CVE-2026-107720
7.4

CVE-2026-107720: Signature Verification Bypass in NearForm fast-jwt

CVE-2026-107720 is a critical signature verification bypass vulnerability in NearForm's fast-jwt Node.js library. Under specific configurations where the token verifier is initialized with a falsy cryptographic key (such as an empty string or null) and a non-empty algorithms allowlist, the library erroneously skips signature validation. This allows unauthenticated remote attackers to submit fabricated, unsigned JSON Web Tokens and bypass the authorization boundary of the application entirely.

Amit Schendel
Amit Schendel
7 views•7 min read
•about 5 hours ago•CVE-2026-107715
6.8

CVE-2026-107715: Information Disclosure and Credential Leakage in Ruby Mechanize via Cross-Origin Redirections

Ruby Mechanize prior to version 2.14.1 contains an information disclosure vulnerability. When executing cross-origin HTTP redirects, global headers configured on the Mechanize agent (such as Authorization or Session Cookies) are dynamically re-applied to the subsequent request, bypassing the internal header-stripping logic. An attacker who controls a redirection endpoint can capture sensitive bearer tokens or cookies.

Alon Barad
Alon Barad
7 views•7 min read