CVE-2025-52573: 
JavaScript vulnerability analysis and mitigation

CVE-2025-52573 is an OS command injection vulnerability in the iOS Simulator MCP Server (ios-simulator-mcp), a Model Context Protocol server for interacting with iOS simulators. All versions prior to 1.3.3 are affected; the vulnerability was disclosed on June 25, 2025, and published to the NVD on June 26, 2025. It carries a CVSS v3.1 base score of 6.0 (Medium/Moderate) (GitHub Advisory, Feedly).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The vulnerable code in src/index.ts (lines 166–207) uses Node.js's child_process.exec API with unsanitized string interpolation to construct shell commands for the ui_tap tool — and similarly for ui_type, ui_swipe, ui_describe_point, ui_describe_all, screenshot, record_video, and stop_recording. User-supplied arguments (duration, udid, x, y) are concatenated directly into a shell command string (e.g., `idb ui tap --udid ${actualUdid} ${durationArg} ${x} ${y} --json`), allowing shell metacharacters such as ;, &&, or # to break out of the intended command and execute arbitrary OS commands on the host (GitHub Advisory, Vulnerable Code). Exploitation typically requires an attacker to manipulate an LLM (via prompt injection or similar techniques) into calling the vulnerable tool with malicious input.

Successful exploitation allows an attacker to execute arbitrary OS commands on the host machine running the MCP Server, with the privileges of the server process. The primary impacts are high integrity loss (e.g., file deletion via rm -rf /tmp) and high availability loss, while confidentiality impact is rated None in the CVSS scoring. Because the MCP Server runs locally on a developer's machine, exploitation could lead to data destruction, unauthorized system access, or further lateral movement within the developer's environment (GitHub Advisory, Feedly).

1. Identify target: Confirm the target developer is running ios-simulator-mcp version < 1.3.3 as an active MCP server connected to an LLM-powered client (e.g., Cursor).
2. Craft prompt injection payload: Prepare a malicious prompt designed to trick the LLM into calling the ui_tap (or other vulnerable) tool with shell metacharacters embedded in one of the injectable arguments (duration, udid, x, or y). Example payload for duration: ; rm -rf /tmp;#.
3. Deliver prompt injection: Inject the malicious prompt into content the LLM will process — for example, via a crafted file, webpage, or message that the LLM reads as part of a task.
4. Trigger tool invocation: The LLM, deceived by the injected prompt, calls ui_tap with the malicious argument, causing the MCP server to construct a shell command such as: idb ui tap --udid <udid> --duration ; rm -rf /tmp;# <x> <y> --json.
5. Achieve command execution: The Node.js exec API passes the full string to the shell, which interprets the injected metacharacters and executes the attacker's arbitrary command on the host system (GitHub Advisory, Vulnerable Code).

• Process: Unexpected child processes spawned by the ios-simulator-mcp Node.js process (e.g., rm, curl, wget, bash, sh, python) that are unrelated to idb, xcrun, or simctl.
• Logs: Shell command execution logs showing idb commands with embedded semicolons, ampersands, or other shell metacharacters in argument strings; Node.js process logs with unexpected command strings.
• File System: Unexpected file deletions, new files, or scripts created in directories accessible to the MCP server process (e.g., /tmp, ~/Downloads); missing files consistent with rm -rf payloads.
• Network: Unexpected outbound network connections from the MCP server process to external IPs, potentially indicating data exfiltration or reverse shell activity.

Upgrade ios-simulator-mcp to version 1.3.3 or later, which replaces the unsafe child_process.exec with child_process.execFile (with shell: false), adds strict input validation via Zod regex patterns for UDIDs and duration fields, and uses -- argument separators to prevent option injection (v1.3.3 Release, Patch Commit). Versions prior to 1.3.3 are no longer supported with security updates. As an interim measure if upgrading is not immediately possible, restrict the MCP server's access to sensitive system resources and apply the principle of least privilege to the process account.

The vulnerability was reported by security researcher Liran Tal, who has published prior work on Node.js secure coding and command injection in MCP servers (GitHub Advisory). The release notes for v1.3.3 reference Snyk's article on exploiting MCP servers vulnerable to command injection as relevant prior research (v1.3.3 Release). The disclosure reflects a broader industry concern about prompt injection and command injection risks in LLM-integrated tooling (MCP servers), a topic gaining increasing attention in the security community.