mcp-package-docs vulnerable to command injection in several tools

Description

A command injection vulnerability exists in the mcp-package-docs MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process’s privileges.

Recommendation

Update the mcp-package-docs package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.1.27
• Patched version(s): 0.1.28

References

• GHSA-vf9j-h32g-2764
• equixly.com
• invariantlabs.ai
• CVE-2025-54073
• CWE-77
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• @elgentos/magento2-dev-mcp vulnerable to command injection - CVE-2026-5603
• Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools - CVE-2025-9611
• MCPHub's ServerController is vulnerable to Command Injection - CVE-2025-11285
• MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server - CVE-2025-58444

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

mcp-package-docs