CVE-2025-69256: Command Injection Vulnerability in Serverless MCP Server's list-projects Tool
Summary
CVE-2025-69256: serverless MCP Server vulnerable to Command Injection in list-projects tool. Affects serverless versions >= 4.29.0, < 4.29.3. Fixed in 4.29.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Serverless Framework is a popular open-source framework that enables developers to build and deploy serverless applications. It simplifies the process of managing cloud services and functions, allowing users to focus on writing code without worrying about infrastructure. The MCP (Model Context Protocol) server is an experimental feature within the Serverless Framework, which is used by a small percentage of users. This feature includes tools like 'list-projects' that help manage serverless projects but has been found to contain a serious security vulnerability.
Vulnerability Detail
A command injection vulnerability exists in the Serverless Framework's MCP server package, specifically in the 'list-projects' tool. This vulnerability arises from the unsanitized use of user input in shell command construction, allowing attackers to inject arbitrary commands. Successful exploitation can lead to remote code execution under the privileges of the server process. The vulnerability is particularly concerning as it can be exploited by sending crafted input to the MCP server, potentially allowing an attacker to execute malicious commands on the server.
How To Fix
Minimum fixed version
4.29.3
This is the first release that contains the fix.
npm install serverless@4.29.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the MCP server feature until you can update to the patched version. Additionally, ensure that the MCP server is not exposed to the internet to mitigate the risk of exploitation.
Conclusion
The command injection vulnerability in the Serverless Framework's MCP server poses a significant risk to users who utilize this experimental feature. It is crucial to update to the patched version to mitigate the risk of remote code execution. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for serverless →
FAQ
The vulnerability is a command injection flaw that allows attackers to execute arbitrary commands on the server.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to execute malicious commands on the server.
Yes, the vulnerability has been patched in version 4.29.3 of the Serverless Framework. Updating to this version will resolve the issue.
If you cannot update immediately, avoid using the MCP server feature and ensure it is not exposed to the internet to reduce the risk of exploitation.
