{"action":"Upgrade @translated/lara-mcp to 0.0.12 or later.","affected":[{"fixed":"0.0.12","introduced":"0"}],"component":"@translated/lara-mcp","cve_ids":["CVE-2025-53832"],"ecosystem":"npm","epss":0.10882,"exploited":false,"fixed_versions":["0.0.12"],"ghsa_id":"GHSA-xj5p-8h7g-76m7","id":"tcs_01M5KGJ6N4Y851HMW39TVRWJR2","modified_at":"2025-07-21T22:21:17Z","published_at":"2025-07-21T14:14:53Z","references":["https://osv.dev/vulnerability/GHSA-xj5p-8h7g-76m7","https://github.com/translated/lara-mcp/security/advisories/GHSA-xj5p-8h7g-76m7","https://nvd.nist.gov/vuln/detail/CVE-2025-53832","https://github.com/translated/lara-mcp/commit/e534ef690adf390e4ac862a200b2a83f6cf45944","https://equixly.com/blog/2025/03/29/mcp-server-new-security-nightmare","https://github.com/translated/lara-mcp","https://github.com/translated/lara-mcp/blob/v0.0.11/src/tools/import_tmx.ts#L56-L61","https://github.com/translated/lara-mcp/blob/v0.0.12/src/mcp/tools/import_tmx.ts","https://invariantlabs.ai/blog/mcp-github-vulnerability"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-xj5p-8h7g-76m7","url":"https://osv.dev/vulnerability/GHSA-xj5p-8h7g-76m7"}],"summary":"@translated/lara-mcp vulnerable to command injection in import_tmx tool"}