{"action":"Upgrade mcp-package-docs to 0.1.28 or later.","affected":[{"fixed":"0.1.28","introduced":"0"}],"component":"mcp-package-docs","cve_ids":["CVE-2025-54073"],"ecosystem":"npm","epss":0.11382,"exploited":false,"fixed_versions":["0.1.28"],"ghsa_id":"GHSA-vf9j-h32g-2764","id":"tcs_01M5KGBND3VQ1NHB1EEDGFRRR5","modified_at":"2026-02-04T03:58:27.664964Z","published_at":"2025-08-05T14:12:33Z","references":["https://osv.dev/vulnerability/GHSA-vf9j-h32g-2764","https://github.com/sammcj/mcp-package-docs/security/advisories/GHSA-vf9j-h32g-2764","https://nvd.nist.gov/vuln/detail/CVE-2025-54073","https://github.com/sammcj/mcp-package-docs/commit/cb4ad49615275379fd6f2f1cf1ec4731eec56eb9","https://equixly.com/blog/2025/03/29/mcp-server-new-security-nightmare","https://github.com/advisories/GHSA-3q26-f695-pp76","https://github.com/advisories/GHSA-5w57-2ccq-8w95","https://github.com/advisories/GHSA-gjv4-ghm7-q58q","https://github.com/sammcj/mcp-package-docs","https://github.com/sammcj/mcp-package-docs/releases/tag/v0.1.27","https://github.com/sammcj/mcp-package-docs/releases/tag/v0.1.28","https://invariantlabs.ai/blog/mcp-github-vulnerability"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-vf9j-h32g-2764","url":"https://osv.dev/vulnerability/GHSA-vf9j-h32g-2764"}],"summary":"mcp-package-docs vulnerable to command injection in several tools"}