CVE-2025-53832 in the critical feed json
@translated/lara-mcp vulnerable to command injection in import_tmx tool
published 2025-07-21 15 mo ago modified 2026-06-17 4 mo ago also GHSA-xj5p-8h7g-76m7 , EUVD-2025-22152
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 10.9%
- EPSS 10.9% chance of exploitation in 30 days, percentile 95%
- public exploits
- 0
- none known
Summary
Lara Translate MCP Server is a Model Context Protocol (MCP) Server for Lara Translate API. Versions 0.0.11 and below contain a command injection vulnerability which exists in the @translated/lara-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. The server constructs and executes shell commands using unvalidated user input directly within command-line strings. This introduces the possibility of shell metacharacter injection (|, >, &&, etc.). This vulnerability is fixed in version 0.0.12.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 15 mo ago
Exploit prediction
10.88% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @translated/lara-mcp | <0.0.12 |
0.0.12 |
Affected products
- translated lara-mcp
Classification
- Weakness
-
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
-
github.com
/translated/lara-mcp/commit/e534ef690adf390e4ac862a200b2a83f6cf45944
web
-
github.com
/translated/lara-mcp/security/advisories/GHSA-xj5p-8h7g-76m7
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-53832
advisory
-
equixly.com
/blog/2025/03/29/mcp-server-new-security-nightmare
web
-
github.com
/translated/lara-mcp
package
-
github.com
/translated/lara-mcp/blob/v0.0.11/src/tools/import_tmx.ts#L56-L61
web
-
github.com
/translated/lara-mcp/blob/v0.0.12/src/mcp/tools/import_tmx.ts
web
-
invariantlabs.ai
/blog/mcp-github-vulnerability
web
Sources
- CVE List CVE-2025-53832
- GitHub Advisory GHSA-xj5p-8h7g-76m7
- NVD CVE-2025-53832
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.