Command Injection in create-mcp-server-stdio via Unsafe exec() Concatenation (CVE-2025-54994)
The create-mcp-server-stdio package builds shell commands by pasting tool arguments directly into exec() calls. If an attacker controls what goes into those arguments, they can slip in shell syntax and run arbitrary commands on the server.
How the attack works
An MCP tool built on this package accepts a parameter that is meant to be a plain value, such as a filename or search term. Instead of passing that value to a program safely, the package concatenates it straight into a string that gets handed to exec(). An attacker supplies a value containing shell metacharacters like ; | && $() or backticks. The shell interprets those characters as command separators or substitutions, so the attacker's injected commands run with whatever privileges the MCP server process has.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 3e1acc2f-6ce9-4fd4-b12f-bfaafe133371
- Severity
- Critical
- CVEs
- CVE-2025-54994
Why it matters
Full remote code execution on the host running the MCP server, including any data the server can read, write, or reach over the network.
What you can do
- →Update create-mcp-server-stdio to a patched version once available, or stop using exec()-based tools built on it.
- →Never build shell command strings by concatenating tool input; use exec/spawn variants that take arguments as an array and avoid shell interpretation entirely.
- →Validate and strictly allow-list tool parameter values (reject shell metacharacters) before they reach any command execution path.
- →Review recent MCP server logs for tool calls containing shell metacharacters in arguments, and check whether flagged sessions match a known authorised workflow before dismissing them.
Known benign look-alikes
- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.