CVE-2025-54073
1 advisory.
npm/mcp-package-docs CVE-2025-54073: high 7.5, EPSS 11.29%
mcp-package-docs vulnerable to command injection in several tools
Action: Upgrade mcp-package-docs to 0.1.28 or later.
npm i mcp-package-docs@0.1.28Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.1.28 | - |
Fixed versions
| 0.1.28 |
Sources
- osv: GHSA-vf9j-h32g-2764
- https://github.com/sammcj/mcp-package-docs/security/advisories/GHSA-vf9j-h32g-2764
- https://nvd.nist.gov/vuln/detail/CVE-2025-54073
- https://github.com/sammcj/mcp-package-docs/commit/cb4ad49615275379fd6f2f1cf1ec4731eec56eb9
- https://equixly.com/blog/2025/03/29/mcp-server-new-security-nightmare
- https://github.com/advisories/GHSA-3q26-f695-pp76
- https://github.com/advisories/GHSA-5w57-2ccq-8w95
- https://github.com/advisories/GHSA-gjv4-ghm7-q58q
- https://github.com/sammcj/mcp-package-docs
- https://github.com/sammcj/mcp-package-docs/releases/tag/v0.1.27
- https://github.com/sammcj/mcp-package-docs/releases/tag/v0.1.28
- https://invariantlabs.ai/blog/mcp-github-vulnerability
CVE-2025-54073 · published · modified · JSON