Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:npm/serverless@4.29.3
Typenpm
Namespace
Nameserverless
Version4.29.3
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version4.29.3
Latest_non_vulnerable_version4.29.3
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-bczs-1cn3-tyfy
vulnerability_id VCID-bczs-1cn3-tyfy
summary 
serverless MCP Server vulnerable to Command Injection in list-projects tool
A command injection vulnerability exists in the Serverless Framework's built-in MCP server package (@serverless/mcp). This vulnerability only affects users of the experimental MCP server feature (serverless mcp), which represents less than 0.1% of Serverless Framework users. The core Serverless Framework CLI and deployment functionality are not affected.

The vulnerability is caused by the unsanitized use of input parameters within a call to `child_process.exec`, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges.

The server constructs and executes shell commands using unvalidated user input directly within command-line strings. This introduces the possibility of shell metacharacter injection (`|`, `>`, `&&`, etc.).
references
0
reference_url https://github.com/serverless/serverless
reference_id
reference_type
scores
url https://github.com/serverless/serverless
1
reference_url https://github.com/serverless/serverless/blob/6213453da7df375aaf12fb3522ab8870488fc59a/packages/mcp/src/tools/list-projects.js#L68
reference_id
reference_type
scores
url https://github.com/serverless/serverless/blob/6213453da7df375aaf12fb3522ab8870488fc59a/packages/mcp/src/tools/list-projects.js#L68
2
reference_url https://github.com/serverless/serverless/commit/681ca039550c7169369f98780c6301a00f2dc4c4
reference_id
reference_type
scores
url https://github.com/serverless/serverless/commit/681ca039550c7169369f98780c6301a00f2dc4c4
3
reference_url https://github.com/serverless/serverless/releases/tag/sf-core%404.29.3
reference_id
reference_type
scores
url https://github.com/serverless/serverless/releases/tag/sf-core%404.29.3
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-69256
reference_id CVE-2025-69256
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2025-69256
5
reference_url https://github.com/advisories/GHSA-rwc2-f344-q6w6
reference_id GHSA-rwc2-f344-q6w6
reference_type
scores
url https://github.com/advisories/GHSA-rwc2-f344-q6w6
6
reference_url https://github.com/serverless/serverless/security/advisories/GHSA-rwc2-f344-q6w6
reference_id GHSA-rwc2-f344-q6w6
reference_type
scores
url https://github.com/serverless/serverless/security/advisories/GHSA-rwc2-f344-q6w6
fixed_packages
0
url pkg:npm/serverless@4.29.3
purl pkg:npm/serverless@4.29.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/serverless@4.29.3
aliases CVE-2025-69256, GHSA-rwc2-f344-q6w6
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bczs-1cn3-tyfy
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:npm/serverless@4.29.3