npm/@samanhappy/mcphub CVE-2025-11285: high 8.8, EPSS 7.79%

MCPHub's ServerController is vulnerable to Command Injection

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-5q2p-3jg8-2m98
• nvd: CVE-2025-11285
• https://github.com/August829/YU1/issues/6
• https://github.com/samanhappy/mcphub
• https://vuldb.com/?ctiid.327043
• https://vuldb.com/?id.327043
• https://vuldb.com/?submit.659734

CVE-2025-11285 · published 2025-10-05T06:30:14Z · modified 2025-10-09T22:42:34.940967Z · JSON