Description
A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController.ts. The manipulation of the argument command/args results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 0.9.10
References
Could your website be exposed too?
SmartScanner can check your website for MCPHub's ServerController is vulnerable to Command Injection and gives you actionable findings to investigate.
Start a free scanRelated Issues
- mcp-package-docs vulnerable to command injection in several tools - CVE-2025-54073
- Flowise Vulnerable to SQL Injection via `tableName` Parameter - CVE-2025-29189
- Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule - CVE-2025-67750
- @elgentos/magento2-dev-mcp vulnerable to command injection - CVE-2026-5603
You might also like:
See something that needs correcting? Let us knowUpdated October 09, 2025