CVE-2025-52573 Command Injection in MCP Server ios-simulator-mcp
Attackers can execute arbitrary commands on the host by injecting shell metacharacters into MCP tool arguments via prompt injection.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-52573?
CVE-2025-52573 is a medium-severity command injection vulnerability in joshuayoes ios-simulator-mcp, published on 26 Jun 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
iOS Simulator MCP Server (ios-simulator-mcp) is a Model Context Protocol (MCP) server for interacting with iOS simulators. Versions prior to 1.3.3 are written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. The MCP Server exposes the tool `ui_tap` which relies on Node.js child process API `exec` which is an unsafe and vulnerable API if concatenated with untrusted user input. LLM exposed user input for `duration`, `udid`, and `x` and `y` args can be replaced with shell meta-characters like `;` or `&&` or others to change the behavior from running the expected command `idb` to another command. When LLMs are tricked through prompt injection (and other techniques and attack vectors) to call the tool with input that uses special shell characters such as `; rm -rf /tmp;#` and other payload variations, the full command-line text will be interepted by the shell and result in other commands except of `ps` executing on the host running the MCP Server. Version 1.3.3 contains a patch for the issue.
Weakness: CWE-78
Which versions are affected by CVE-2025-52573?
2 open source packages ship an affected version, including ios-simulator-mcp.
| Package | Affected | Fixed in |
|---|---|---|
ios-simulator-mcp npm | All versions | 1.3.3 |
ios-simulator-mcp npm | All versions | 1.3.3 |
How do I fix CVE-2025-52573?
Upgrade ios-simulator-mcp to 1.3.3 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-52573 being exploited?
There is no known exploitation of CVE-2025-52573 in the wild and no public exploit code.
Sources
Also known as GHSA-6f6r-m9pv-67jw.