CVE-2025-53832

npm/@translated/lara-mcp CVE-2025-53832: high 7.5, EPSS 10.88%

@translated/lara-mcp vulnerable to command injection in import_tmx tool

Action: Upgrade @translated/lara-mcp to 0.0.12 or later.

npm i @translated/lara-mcp@0.0.12

Affected

Fixed versions

Sources

• osv: GHSA-xj5p-8h7g-76m7
• https://github.com/translated/lara-mcp/security/advisories/GHSA-xj5p-8h7g-76m7
• https://nvd.nist.gov/vuln/detail/CVE-2025-53832
• https://github.com/translated/lara-mcp/commit/e534ef690adf390e4ac862a200b2a83f6cf45944
• https://equixly.com/blog/2025/03/29/mcp-server-new-security-nightmare
• https://github.com/translated/lara-mcp
• https://github.com/translated/lara-mcp/blob/v0.0.11/src/tools/import_tmx.ts#L56-L61
• https://github.com/translated/lara-mcp/blob/v0.0.12/src/mcp/tools/import_tmx.ts
• https://invariantlabs.ai/blog/mcp-github-vulnerability

CVE-2025-53832 · published 2025-07-21T14:14:53Z · modified 2025-07-21T22:21:17Z · JSON