CVE-2025-53355
CVE-2025-53355 · mcp-server-kubernetes vulnerable to command injection in several tools
This page contains facts from public vulnerability sources. Check the original advisory before updating.
MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. A command injection vulnerability exists in the mcp-server-kubernetes MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.execSync, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. This vulnerability is fixed in 2.5.0.
CVSS 7.5 · High · EPSS 2.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
mcp-server-kubernetes
- Versions
- < 2.5.0: Affected
No fix published
mcp-server-kubernetes npm
- Affected ranges
- SEMVER: < 2.5.0
Update to 2.5.0
Original sources
- https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-gjv4-ghm7-q58q
- https://github.com/Flux159/mcp-server-kubernetes/commit/ab165f5a0eea917fef5dbae954506fff6f4bf514
- https://github.com/cyanheads/git-mcp-server/commit/0dbd6995ccdf76ab770b58013034365b2d06c4d9
- https://nvd.nist.gov/vuln/detail/CVE-2025-53355