CVE-2025-53355

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. A command injection vulnerability exists in the mcp-server-kubernetes MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.execSync, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. This vulnerability is fixed in 2.5.0.

• CWE-77

• https://github.com/Flux159/mcp-server-kubernetes/commit/ab165f5a0eea917fef5dbae954506fff6f4bf514
• https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-gjv4-ghm7-q58q
• https://github.com/cyanheads/git-mcp-server/commit/0dbd6995ccdf76ab770b58013034365b2d06c4d9
• https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-gjv4-ghm7-q58q

Published

Jul 8, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-53349Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-5335A maliciously crafted binary file when downloaded could lead…7.8
• CVE-2025-53350Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-53351Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-53352Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-53354NiceGUI is a Python-based UI framework. Versions 2.24.2 and …6.1
• CVE-2025-53357GLPI, which stands for Gestionnaire Libre de Parc Informatiq…5.4
• CVE-2025-53358kotaemon is an open-source RAG-based tool for document compr…6.5
• CVE-2025-53359ethereum is a common ethereum structs for Rust. Prior to eth…6.9
• CVE-2025-5336The Click to Chat plugin for WordPress is vulnerable to Stor…6.4
• CVE-2025-53360pluginsGLPI's Database Inventory Plugin "manages" the Teclib…4.3
• CVE-2025-53363dpanel is an open source server management panel written in …4.8