{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.9.10"}],"component":"@samanhappy/mcphub","cve_ids":["CVE-2025-11285"],"ecosystem":"npm","epss":0.07857,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-5q2p-3jg8-2m98","id":"tcs_01M5KF4DE45M8ZWT88DB0ZBJ3B","modified_at":"2025-10-09T22:42:34.940967Z","published_at":"2025-10-05T06:30:14Z","references":["https://osv.dev/vulnerability/GHSA-5q2p-3jg8-2m98","https://nvd.nist.gov/vuln/detail/CVE-2025-11285","https://github.com/August829/YU1/issues/6","https://github.com/samanhappy/mcphub","https://vuldb.com/?ctiid.327043","https://vuldb.com/?id.327043","https://vuldb.com/?submit.659734"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-5q2p-3jg8-2m98","url":"https://osv.dev/vulnerability/GHSA-5q2p-3jg8-2m98"},{"source":"nvd","source_id":"CVE-2025-11285","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11285"}],"summary":"MCPHub's ServerController is vulnerable to Command Injection"}