{"action":"Upgrade ios-simulator-mcp to 1.3.3 or later.","affected":[{"fixed":"1.3.3","introduced":"0"}],"component":"ios-simulator-mcp","cve_ids":["CVE-2025-52573"],"ecosystem":"npm","epss":0.0064,"exploited":false,"fixed_versions":["1.3.3"],"ghsa_id":"GHSA-6f6r-m9pv-67jw","id":"tcs_01M5KF6RXYGYGGZDKVG1TQR7HP","modified_at":"2025-06-26T21:44:42.182968Z","published_at":"2025-06-26T21:20:37Z","references":["https://osv.dev/vulnerability/GHSA-6f6r-m9pv-67jw","https://github.com/joshuayoes/ios-simulator-mcp/security/advisories/GHSA-6f6r-m9pv-67jw","https://nvd.nist.gov/vuln/detail/CVE-2025-52573","https://github.com/joshuayoes/ios-simulator-mcp/commit/eb53a4f2cc8bbeb13e8d6d930f00167befcdb809","https://github.com/joshuayoes/ios-simulator-mcp","https://github.com/joshuayoes/ios-simulator-mcp/blob/main/src/index.ts#L166-L207","https://github.com/joshuayoes/ios-simulator-mcp/releases/tag/v1.3.3"],"severity":{"label":"medium","score":6},"sources":[{"source":"osv","source_id":"GHSA-6f6r-m9pv-67jw","url":"https://osv.dev/vulnerability/GHSA-6f6r-m9pv-67jw"}],"summary":"iOS Simulator MCP Command Injection allowed via exec API"}