CVE-2025-69256 serverless MCP Server vulnerable to command injection in list-projects tool
Attackers can execute arbitrary system commands via the experimental MCP server's list-projects tool, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-69256?
CVE-2025-69256 is a high-severity command injection vulnerability in serverless, published on 30 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build applications. Starting in version 4.29.0 and prior to version 4.29.3, a command injection vulnerability exists in the Serverless Framework's built-in MCP server package (@serverless/mcp). This vulnerability only affects users of the experimental MCP server feature (serverless mcp), which represents less than 0.1% of Serverless Framework users. The core Serverless Framework CLI and deployment functionality are not affected. The vulnerability is caused by the unsanitized use of input parameters within a call to `child_process.exec`, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. The server constructs and executes shell commands using unvalidated user input directly within command-line strings. This introduces the possibility of shell metacharacter injection (`|`, `>`, `&&`, etc.). Version 4.29.3 fixes the issue.
Weakness: CWE-77
Which versions are affected by CVE-2025-69256?
2 open source packages ship an affected version, including serverless. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
serverless npm | From 4.29.0 | 4.29.3 |
serverless npm | From 4.29.0 | 4.29.3 |
Products include Serverless Serverless.
How do I fix CVE-2025-69256?
Upgrade serverless to 4.29.3 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-69256 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-69256 exists.
Public exploit code: 3 proofs of concept on GitHub.
Sources
Also known as GHSA-rwc2-f344-q6w6.