CVE-2025-69256
The Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build applications. Starting in version 4.29.0 and prior to version 4.29.3, a command injection vuln...
Affects 1 product across 1 vendor.
Attacker injects operating system commands through application inputs passed to a shell or system call.
Show all 8
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A command injection vulnerability exists in the Serverless Framework's built-in MCP server package (@serverless/mcp) affecting versions 4.29.0 to 4.29.2. This vulnerability can be exploited by attackers to execute arbitrary commands on the system, potentially leading to unauthorized access or system compromise.
BSID: BS-2025-GLOBAL-032553-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2025-69256?
What is the CVSS score for CVE-2025-69256?
Is CVE-2025-69256 actively exploited?
How do I remediate CVE-2025-69256?
What systems are affected by CVE-2025-69256?
| CVE ID | CVE-2025-69256 |
|---|---|
| BSID | BS-2025-GLOBAL-032553-H BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| Published | 2025-12-30 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
The Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build applications. Starting in version 4.29.0 and prior to version 4.29.3, a command injection vulnerability exists in the Serverless Framework's built-in MCP server package (@serverless/mcp). This vulnerability only affects users of the experimental MCP server feature (serverless mcp), which represents less than 0.1% of Serverless Framework users. The core Serverless Framework CLI and deployment functionality are not affected. The vulnerability is caused by the unsanitized use of input parameters within a call to `child_process.exec`, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. The server constructs and executes shell commands using unvalidated user input directly within command-line strings. This introduces the possibility of shell metacharacter injection (`|`, `>`, `&&`, etc.). Version 4.29.3 fixes the issue.
Source: NIST NVD / MITRE CVE Database
The vulnerability arises from improper input validation in the MCP server feature, allowing attackers to inject malicious commands through specific parameters. This can be exploited if an attacker can control the input to the MCP server commands.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Affected Versions |
|---|---|---|
| Serverless | Serverless | ≥ 4.29.0, < 4.29.3 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | MEDIUM |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | b6efd48e28b0ff55781e83ab82707e4f2cb29f31dbe27531f86f11a12467ee2b7264d2f53c1ec7864742da811e651a87f26a1bf584195f3f20e77f30482ff35b |
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.
Create a free account →