CVE-2025-53372: node-code-sandbox-mcp RCE Vulnerability

CVE-2025-53372 Overview

CVE-2025-53372 is a command injection vulnerability in node-code-sandbox-mcp, a Node.js-based Model Context Protocol (MCP) server that provisions disposable Docker containers to execute arbitrary JavaScript. Versions prior to 1.3.0 pass unsanitized input parameters directly into a child_process.execSync call, allowing an attacker to inject arbitrary system commands. Successful exploitation results in remote code execution under the server process's privileges on the host machine, bypassing the Docker sandbox boundary that the project is designed to enforce. The maintainer released a fix in version 1.3.0. The vulnerability is tracked under CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact
Attackers who can supply parameters to the MCP server can execute arbitrary host commands, escaping the intended Docker sandbox isolation.

Affected Products

node-code-sandbox-mcp versions prior to 1.3.0
MCP server deployments embedding node-code-sandbox-mcp for sandboxed JavaScript execution
AI assistant integrations relying on node-code-sandbox-mcp for tool execution

Discovery Timeline

2025-07-08 - CVE-2025-53372 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-53372

Vulnerability Analysis

The node-code-sandbox-mcp server exposes MCP tools that orchestrate Docker containers to execute untrusted JavaScript. To manage these containers, the server invokes the Docker CLI through child_process.execSync. The vulnerability arises because user-controlled parameters are interpolated directly into the shell command string passed to execSync without escaping or argument-array separation.

An attacker who can influence parameters processed by the MCP tool, such as image names, file paths, or container identifiers, can inject shell metacharacters. The injected payload runs in the shell context of the MCP server process on the host, not inside the Docker container. This defeats the project's core security guarantee that untrusted code is confined to ephemeral containers.

In typical MCP deployments, the server runs alongside an AI assistant or developer tool, often with broad access to the local environment. Exploitation therefore yields code execution with the privileges of the user running the MCP server.

Root Cause

The root cause is the use of child_process.execSync with concatenated user input rather than child_process.execFileSync or spawnSync with an argument array. execSync invokes /bin/sh -c, which interprets shell metacharacters such as ;, &&, |, and backticks. Without input neutralization, any of these characters in attacker-controlled parameters break out of the intended command.

Attack Vector

Exploitation requires the attacker to deliver a crafted parameter to a vulnerable MCP tool invocation. In an AI assistant context, this can occur through prompt injection that causes the assistant to call the tool with an attacker-supplied argument. The MCP server then executes the injected command on the host. Because the attack vector is network-reachable through the MCP transport and requires user interaction with the assistant, exploitation depends on the surrounding deployment model.

javascript

// Patch excerpt from eslint.config.js
         ecmaVersion: 12,
         sourceType: 'module',
       },
-      env: {
-        node: true,
-        es2021: true,
-      },
     },
     plugins: {
       '@typescript-eslint': tsPlugin,

Source: GitHub commit e461a74

The broader patch in this commit replaces unsafe shell command construction with sanitized invocations and updates the example Playwright image to v1.53.2-noble.

Detection Methods for CVE-2025-53372

Indicators of Compromise

Unexpected child processes spawned by the Node.js process running node-code-sandbox-mcp, such as /bin/sh -c invocations containing shell metacharacters.
Docker CLI invocations with anomalous arguments that include ;, &&, |, $(), or backticks in image, container, or path parameters.
Outbound network connections from the MCP server host process to unfamiliar destinations following MCP tool calls.

Detection Strategies

Audit node-code-sandbox-mcp package versions across developer workstations and servers, flagging any release below 1.3.0.
Instrument the MCP server process for command execution telemetry and alert on shell invocations containing metacharacters in arguments.
Review MCP tool call logs for parameters that contain shell control characters or unusual whitespace patterns.

Monitoring Recommendations

Monitor process lineage where node is the parent and sh, bash, or docker are children with concatenated argument strings.
Track filesystem changes outside the expected Docker workspace directories used by the MCP server.
Log all MCP tool invocations with full parameter values for retrospective analysis when prompt-injection attacks are suspected.

How to Mitigate CVE-2025-53372

Immediate Actions Required

Upgrade node-code-sandbox-mcp to version 1.3.0 or later in every environment where it is installed.
Inventory AI assistant and IDE configurations that register node-code-sandbox-mcp as an MCP tool and confirm they reference the patched version.
Restrict the privileges of the user account running the MCP server, including filesystem and Docker socket access, to limit blast radius.

Patch Information

The fix is delivered in node-code-sandbox-mcp version 1.3.0. The maintainer's remediation is documented in GitHub Security Advisory GHSA-5w57-2ccq-8w95 and the corresponding patch commit e461a74. The patch replaces unsanitized child_process.execSync usage with input validation and safer process invocation.

Workarounds

If immediate upgrade is not possible, disable the node-code-sandbox-mcp server in MCP client configurations.
Run the MCP server inside a dedicated low-privilege container or virtual machine with no access to sensitive host resources.
Filter or validate parameters at the MCP client layer to reject inputs containing shell metacharacters before they reach the server.

bash

# Upgrade node-code-sandbox-mcp to the patched release
npm install node-code-sandbox-mcp@1.3.0

# Verify the installed version
npm ls node-code-sandbox-mcp