CVE-2025-69256: Serverless Framework MCP RCE Vulnerability

CVE-2025-69256 Overview

A command injection vulnerability has been identified in the Serverless Framework's experimental MCP (Model Context Protocol) server package (@serverless/mcp). The vulnerability exists due to unsanitized use of input parameters within calls to child_process.exec, enabling attackers to inject arbitrary system commands through shell metacharacter injection. Successful exploitation can lead to remote code execution under the server process's privileges.

Critical Impact

This command injection vulnerability allows attackers to execute arbitrary system commands on servers running the experimental MCP server feature, potentially leading to complete system compromise under the server process's privileges.

Affected Products

• Serverless Framework versions 4.29.0 to 4.29.2
• @serverless/mcp package (experimental MCP server feature)
• Users running serverless mcp command

Discovery Timeline

• 2025-12-30 - CVE-2025-69256 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2025-69256

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Command Injection), a critical class of security flaws where user-controlled input is passed unsanitized to system command execution functions. The MCP server package constructs shell commands using unvalidated user input directly within command-line strings passed to child_process.exec. This design flaw introduces the possibility of shell metacharacter injection using characters such as |, >, &&, and others.

The vulnerability specifically affects the project finder functionality within the MCP server, where workspace directory paths are processed without proper validation. An attacker can craft malicious input containing shell metacharacters that break out of the intended command context and execute arbitrary commands.

While the vulnerability has a network-based attack vector, exploitation requires user interaction and high attack complexity, limiting the attack surface. Importantly, this vulnerability only affects users of the experimental MCP server feature (serverless mcp), which represents less than 0.1% of Serverless Framework users. The core Serverless Framework CLI and deployment functionality remain unaffected.

Root Cause

The root cause lies in the use of child_process.exec with unsanitized user input. The exec function spawns a shell to execute commands, making it inherently vulnerable to command injection when user-controlled data is interpolated into the command string. Additionally, the workspace directory parameter lacked proper validation to ensure it was a legitimate directory path, allowing attackers to inject malicious payloads disguised as path arguments.

Attack Vector

The attack vector is network-based, requiring an attacker to interact with the MCP server's exposed functionality. By supplying crafted input containing shell metacharacters (such as ; rm -rf /, | cat /etc/passwd, or && wget malicious-payload), an attacker can inject additional commands that execute with the same privileges as the server process. The injection point is the workspaceDir parameter in the project finder functionality.

 import fs from 'fs'
 import path from 'path'
 import { promisify } from 'util'
-import { exec } from 'child_process'
+import { execFile } from 'child_process'
 import { enhanceProjectsWithServiceDetails } from './serverless-framework/service-details.js'
 
-const execAsync = promisify(exec)
+const execFileAsync = promisify(execFile)
 const readFileAsync = promisify(fs.readFile)
+const statAsync = promisify(fs.stat)
+
+/**
+ * Validate that the provided path is an existing directory
+ *
+ * @param {string} dirPath - The directory path to validate
+ * @returns {Promise<string>} - The validated absolute path
+ * @throws {Error} - If the path is not a valid directory
+ */
+async function validateWorkspaceDir(dirPath) {
+  if (!dirPath || typeof dirPath !== 'string') {
+    throw new Error('Workspace directory must be a non-empty string')
+  }
+
+  // Resolve to absolute path to prevent relative path tricks
+  const absolutePath = path.resolve(dirPath)
+
+  // Verify the path exists and is a directory
+  const stats = await statAsync(absolutePath)
+  if (!stats.isDirectory()) {

Source: GitHub Commit Details

Detection Methods for CVE-2025-69256

Indicators of Compromise

• Unusual process spawning from Node.js or Serverless Framework processes
• Unexpected shell commands executed with MCP server process privileges
• Network connections to suspicious external hosts from server processes
• Log entries showing malformed workspace directory paths containing shell metacharacters

Detection Strategies

• Monitor process execution chains for anomalous child processes spawned by Node.js applications running Serverless Framework
• Implement input validation logging to detect attempts to pass shell metacharacters in workspace directory parameters
• Use endpoint detection and response (EDR) solutions to identify command injection patterns
• Review server logs for requests containing suspicious characters (|, &&, ;, >, $(), backticks)

Monitoring Recommendations

• Enable verbose logging for MCP server operations to capture incoming requests and parameters
• Implement application-level monitoring to detect unusual system calls from the Serverless Framework process
• Configure security information and event management (SIEM) rules to alert on command injection patterns
• Monitor for unauthorized file system access or network connections from server processes

How to Mitigate CVE-2025-69256

Immediate Actions Required

• Upgrade Serverless Framework to version 4.29.3 or later immediately
• If upgrade is not immediately possible, disable the experimental MCP server feature by avoiding use of the serverless mcp command
• Audit logs for any suspicious activity that may indicate exploitation attempts
• Review and restrict network access to systems running the MCP server feature

Patch Information

The vulnerability has been fixed in Serverless Framework version 4.29.3. The fix replaces the vulnerable child_process.exec function with child_process.execFile, which does not spawn a shell and thus is not susceptible to shell metacharacter injection. Additionally, the patch implements proper validation of the workspaceDir parameter to ensure it is a non-empty string that resolves to an existing directory, preventing path manipulation attacks.

For detailed patch information, refer to the GitHub Security Advisory GHSA-rwc2-f344-q6w6 and the security fix commit.

Workarounds

• Disable or avoid using the experimental MCP server feature (serverless mcp) until the patch can be applied
• Implement network-level access controls to restrict which clients can communicate with the MCP server
• Run the MCP server process with minimal privileges to limit the impact of potential exploitation
• Deploy Web Application Firewall (WAF) rules to filter requests containing shell metacharacters

# Upgrade Serverless Framework to patched version
npm update serverless@4.29.3

# Alternatively, if using yarn
yarn upgrade serverless@4.29.3

# Verify installed version
serverless --version