RCE in Akoskm Create-mcp-server-stdio
CVE-2025-54994
@akoskm/create-mcp-server-stdio is an MCP server starter kit that uses the StdioServerTransport. Prior to version 0.0.13, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of i…
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.014 (68.5th percentile) — read the EPSS interpretation.
Affected products
- Akoskm Create-mcp-server-stdio — versions < 0.0.13
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)