CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-69256

Serverless Command Injection: When 'Experimental' Means 'Remote Shell'

Alon Barad
Alon Barad
Software Engineer

Jan 1, 2026·4 min read·67 visits

Executive Summary (TL;DR)

A classic OS Command Injection vulnerability in the Serverless Framework's MCP server (`@serverless/mcp`). The `list-projects` tool passed unvalidated user input directly into a `find` command spawned via `child_process.exec`. This allowed Remote Code Execution (RCE) on the developer's machine. Fixed in version 4.29.3 by switching to `execFile` and implementing path validation.

The Serverless Framework's experimental Model Context Protocol (MCP) server contained a critical command injection vulnerability. By failing to sanitize directory paths passed to a shell command, the tool allowed attackers—or confused LLMs—to execute arbitrary system commands.

Official Patches

ServerlessRelease notes for version 4.29.3 containing the fix.

Fix Analysis (1)

Technical Appendix

CVSS Score
7.5/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Probability
0.04%
Top 99% most exploited

Affected Systems

Serverless Framework CLI (Experimental MCP Server)

Affected Versions Detail

Product
Affected Versions
Fixed Version
Serverless Framework (MCP)
Serverless, Inc.
4.29.0 - 4.29.24.29.3
AttributeDetail
CWE IDCWE-78 (OS Command Injection)
CVSS Score7.5 (High)
Attack VectorNetwork / Local (via MCP Interface)
ImpactHigh (Confidentiality, Integrity, Availability)
Component@serverless/mcp
Vulnerable FunctionfindServerlessFrameworkProjects (via child_process.exec)

MITRE ATT&CK Mapping

T1059Command and Scripting Interpreter
Execution
T1204User Execution
Execution
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Known Exploits & Detection

GitHub AdvisoryProof of concept demonstrating directory traversal and command execution.

Vulnerability Timeline

Vulnerability identified and patch committed (681ca03)
2025-02-17
Serverless Framework v4.29.3 released
2025-02-19
Advisory GHSA-rwc2-f344-q6w6 published
2025-02-20

References & Sources

  • [1]GitHub Advisory: Command Injection in @serverless/mcp
  • [2]Node.js Documentation: child_process.exec Security Risks

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•21 minutes ago•CVE-2026-105806
8.6

CVE-2026-105806: Privilege Escalation and Missing Authorization in @payloadcms/plugin-mcp

CVE-2026-105806 is an improper access control vulnerability within the Model Context Protocol (MCP) plugin for Payload CMS. Authenticated users with low privileges can manipulate API key creation and mapping to associate keys with arbitrary users, including administrators. This allows total session takeovers and privilege escalation via MCP-authenticated API requests.

Alon Barad
Alon Barad
2 views•5 min read
•about 1 hour ago•CVE-2026-105848
6.4

CVE-2026-105848: Insufficient Access Control in Payload CMS Stripe REST Proxy

An access control vulnerability in `@payloadcms/plugin-stripe` allows authenticated low-privilege users to bypass authorization boundaries and execute arbitrary, highly privileged operations on the connected Stripe platform via an exposed REST proxy.

Alon Barad
Alon Barad
3 views•7 min read
•about 2 hours ago•CVE-2026-105851
9.3

CVE-2026-105851: Privilege Escalation via Field Access Control Bypass in Payload CMS Duplication Mechanism

A critical access control bypass vulnerability (CVE-2026-105851) in Payload CMS allows authenticated users to bypass field-level access controls during document duplication. By duplicating high-privilege documents, such as administrator accounts, standard users can inherit sensitive fields (e.g., role configurations or API keys), leading to privilege escalation.

Alon Barad
Alon Barad
6 views•7 min read
•about 3 hours ago•CVE-2026-105853
7.1

CVE-2026-105853: Sensitive Information Disclosure and Authentication Collection Boundary Bypass in Payload CMS

CVE-2026-105853 is a high-severity information disclosure vulnerability in Payload CMS that affects authentication-enabled collections. In vulnerable versions, the application fails to properly serialize and sanitize user documents during token refresh and password reset operations. This deficiency leaks hidden and read-restricted fields to unauthorized actors. Additionally, a logical flaw in token refresh validation allows low-privileged users to cross collection boundaries, exposing sensitive configuration details and administrative metadata.

Amit Schendel
Amit Schendel
6 views•5 min read
•about 4 hours ago•CVE-2026-105852
5.3

CVE-2026-105852: Authorization Bypass and Related-Document Oracle in Payload CMS

An authorization bypass vulnerability in Payload CMS enables unauthenticated attackers to query and infer the existence of restricted documents via nested relationship queries on public collections. This cross-document contamination flaw affects both MongoDB and Drizzle SQL database adapters, allowing unauthorized reads of relationship metadata.

Amit Schendel
Amit Schendel
5 views•6 min read
•about 5 hours ago•CVE-2026-105850
8.8

CVE-2026-105850: Race Condition and Order Double-Processing in @payloadcms/plugin-ecommerce

A high-severity race condition vulnerability exists in @payloadcms/plugin-ecommerce within the Stripe payment adapter's order confirmation pipeline. Unauthenticated attackers or parallel webhook deliveries can exploit sequential, non-atomic database operations to bypass state verifications, leading to duplicate order creation, multiple inventory decrements, and inconsistent database records.

Amit Schendel
Amit Schendel
6 views•7 min read