CVE-2025-53832

Lara Translate MCP Server is a Model Context Protocol (MCP) Server for Lara Translate API. Versions 0.0.11 and below contain a command injection vulnerability which exists in the @translated/lara-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. The server constructs and executes shell commands using unvalidated user input directly within command-line strings. This introduces the possibility of shell metacharacter injection (|, >, &&, etc.). This vulnerability is fixed in version 0.0.12.

• CWE-77

• https://github.com/translated/lara-mcp/commit/e534ef690adf390e4ac862a200b2a83f6cf45944
• https://github.com/translated/lara-mcp/security/advisories/GHSA-xj5p-8h7g-76m7

Published

Jul 21, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-53827ownCloud Core is the server-side component of the file stora…9.1
• CVE-2025-53828SharePoint for ownCloud is an application for using SharePoi…8.5
• CVE-2025-53829ownCloud is a file storage, synchronization, and sharing app…8
• CVE-2025-5383A vulnerability was found in Yifang CMS up to 2.0.2 and clas…4.8
• CVE-2025-53830Anti-Virus for ownCloud is an anti-virus application for fil…9.1
• CVE-2025-53831DrawIO for ownCloud is an application for using DrawIO with …8.2
• CVE-2025-53833LaRecipe is an application that allows users to create docum…10
• CVE-2025-53834Caido is a web security auditing toolkit. A reflected cross-…6.3
• CVE-2025-53835XWiki Rendering is a generic rendering system that converts …9
• CVE-2025-53836XWiki Rendering is a generic rendering system that converts …8.8
• CVE-2025-53838LinkAce is a self-hosted archive to collect website links. A…5.4
• CVE-2025-53839DRACOON is a file sharing service, and the DRACOON Branding …4