p PatchFirst

PatchFirst · Latest vulnerabilities

@akoskm/create-mcp-server-stdio vulnerabilities

Vulnerabilities published for @akoskm/create-mcp-server-stdio in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2025-54994

    Critical · CVSS 9.3EPSS 1.34%Fix available

    @akoskm/create-mcp-server-stdio has Command Injection in MCP Server due to unsafe `exec` API

    @akoskm/create-mcp-server-stdio is an MCP server starter kit that uses the StdioServerTransport. Prior to version 0.0.13, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. The MCP Server exposes the tool `which-app-on-port` which relies on Node.js child process API `exec` which is an unsafe and vulnerable API if concatenated with untrusted user input. Version 0.0.13 contains a fix for the issue.

    @akoskm/create-mcp-server-stdioNode.js
    • Update to 0.0.13
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →