MCPHub's ServerController is vulnerable to Command Injection

Description

A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController.ts. The manipulation of the argument command/args results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.9.10

References

• GHSA-5q2p-3jg8-2m98
• vuldb.com
• CVE-2025-11285
• CWE-77
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• mcp-package-docs vulnerable to command injection in several tools - CVE-2025-54073
• Flowise Vulnerable to SQL Injection via `tableName` Parameter - CVE-2025-29189
• Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule - CVE-2025-67750
• @elgentos/magento2-dev-mcp vulnerable to command injection - CVE-2026-5603

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@samanhappy/mcphub