CVE-2025-54994

npm/@akoskm/create-mcp-server-stdio CVE-2025-54994: critical, EPSS 1.34%

@akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through `exec` API

Action: Upgrade @akoskm/create-mcp-server-stdio to 0.0.13 or later.

npm i @akoskm/create-mcp-server-stdio@0.0.13

Affected

Fixed versions

Sources

• osv: GHSA-3ch2-jxxc-v4xf
• https://github.com/akoskm/create-mcp-server-stdio/security/advisories/GHSA-3ch2-jxxc-v4xf
• https://nvd.nist.gov/vuln/detail/CVE-2025-54994
• https://github.com/akoskm/create-mcp-server-stdio/pull/1
• https://github.com/akoskm/create-mcp-server-stdio/commit/48c26bbe1f8c62764e4592f33c8300d1cadd2eac
• https://github.com/akoskm/create-mcp-server-stdio
• https://github.com/akoskm/create-mcp-server-stdio/blob/main/src/index.ts#L24-L40

CVE-2025-54994 · published 2025-09-08T19:42:34Z · modified 2025-09-10T21:03:16Z · JSON