CVE-2025-53100

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-53100

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53100.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-53100

Aliases

GHSA-fhq6-jf5q-qxvq

Published

2025-07-01T17:49:54Z

Modified

2026-10-28T02:30:30Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

RestDB's Codehooks.io MCP Server Vulnerable to Command Injection

Details

RestDB's Codehooks.io MCP Server is an MCP server on the Codehooks.io platform. Prior to version 0.2.2, the MCP server is written in a way that is vulnerable to command injection attacks as part of some of its MCP Server tools definition and implementation. This could result in a user initiated remote command injection attack on a running MCP Server. This issue has been patched in version 0.2.2.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53100.json"
}

References

Affected packages

Git / github.com/restdb/codehooks-mcp-server

Affected ranges

Type

GIT

Repo

https://github.com/restdb/codehooks-mcp-server

Events

Introduced

Fixed

62f918a6fde6a8c700521b542b85315c70f05794

Fixed

83db1d1b4c856cbe4a1b961d315706198bb0ffb8

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.2.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "62f918a6fde6a8c700521b542b85315c70f05794"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "83db1d1b4c856cbe4a1b961d315706198bb0ffb8"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v0.*

v0.1.0

v0.1.1

v0.1.2

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.2.0

v0.2.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53100.json"