CVE-2025-54073: mcp-package-docs Command Injection Vulnerability
Summary
CVE-2025-54073: mcp-package-docs vulnerable to command injection in several tools. Affects mcp-package-docs versions < 0.1.28. Fixed in 0.1.28. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mcp-package-docs is a tool designed to facilitate access to documentation for various package types within the MCP Server. It allows users to execute commands related to package documentation. However, it has been identified to have a critical vulnerability that can be exploited through unsanitized user inputs, leading to severe security risks.
Vulnerability Detail
A command injection vulnerability exists in the mcp-package-docs MCP Server due to the unsanitized use of input parameters in calls to child_process.exec. This flaw allows attackers to inject arbitrary system commands, potentially leading to remote code execution with the privileges of the server process. The vulnerability arises from the construction and execution of shell commands using unvalidated user input, making it susceptible to shell metacharacter injection.
How To Fix
Minimum fixed version
0.1.28
This is the first release that contains the fix.
npm install mcp-package-docs@0.1.28Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using child_process.exec with untrusted input. Instead, consider using child_process.execFile, which allows you to pass arguments as a separate array, thus preventing shell interpretation. Here’s an example of how to implement this:
const { execFile } = require('child_process');
const execFileAsync = promisify(execFile);
const cmd = 'go';
const args = symbol ? [ 'doc', `${packageName}.${symbol}` ] : [ 'doc', packageName ];
const { stdout } = await execFileAsync(cmd, args);
Conclusion
The mcp-package-docs package has a critical command injection vulnerability (CVE-2025-54073) that can lead to severe security risks. It is essential to update to the patched version or implement workarounds to mitigate the risk. Regular monitoring and vulnerability management are crucial for maintaining application security.
See every vulnerability recorded for mcp-package-docs →
FAQ
CVE-2025-54073 is a command injection vulnerability found in the mcp-package-docs package, allowing attackers to execute arbitrary commands on the server.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to execute arbitrary commands on the server, potentially compromising sensitive data and system integrity.
To update the package, run the command 'npm install mcp-package-docs@0.1.28' in your terminal to install the patched version.
If an immediate update is not possible, consider implementing a workaround by using child_process.execFile instead of child_process.exec to avoid executing untrusted input.
