{"vulnerability": "CVE-2025-69256", "sightings": [{"uuid": "6c70476d-2b02-476f-99dd-9f48e9605f0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-69256", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mba2t6ve4l2u", "content": "", "creation_timestamp": "2025-12-30T19:16:29.751080Z"}, {"uuid": "6e3ba427-14d0-49e3-b2be-a665e4a8126f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-69256", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mbagyu7j3h2q", "content": "", "creation_timestamp": "2025-12-30T22:54:36.585872Z"}, {"uuid": "ef11dd71-0b3a-40f4-b4c2-17c998c88e04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-69256", "type": "seen", "source": "https://bsky.app/profile/azu.bsky.social/post/3mbd25gvgx72y", "content": "", "creation_timestamp": "2025-12-31T23:42:18.263149Z"}, {"uuid": "45320925-ee89-4cad-a1f1-a8edd79b4f8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-69256", "type": "seen", "source": "https://gist.github.com/alon710/1b374eaf78dadda1b4eab4b9c4ec88f1", "content": "", "creation_timestamp": "2026-01-24T22:44:27.000000Z"}, {"uuid": "2d92eef4-7929-45b9-9f29-f06c919e464b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-69256", "type": "seen", "source": "Telegram/KY4Khmwkh6j6K3FO9XZ4bHMgqdxLW7Vbu4w-UqAnKuDAQvc", "content": "", "creation_timestamp": "2026-04-28T03:00:06.000000Z"}, {"uuid": "1cad4cdf-2b81-4d02-8654-2534ba43b1f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-69256", "type": "seen", "source": "Telegram/xvoYgOFnUf5jFw65_bW2FC7fcn6orx4l4LTjm0d68ZkOEzo", "content": "", "creation_timestamp": "2026-05-08T03:00:06.000000Z"}, {"uuid": "6cb1691a-f76d-4ef5-8f59-86f6ed370041", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-69256", "type": "seen", "source": "https://t.me/htfgtps/1226", "content": "CVE-2025-69256\nThe Serverless Framework is a framework\nfor using AWS Lambda and other managed\ncloud services to build applications.\nStarting in version 4.29.0 and prior to\nversion 4.29.3, a command injection\nvulnerability exists in the Serverless\nFramework's built-in MCP server package\n(@serverless/mcp). This vulnerability only\naffects users of the experimental MCP\nserver feature (serverless mcp), which\nrepresents less than 0.1% of Serverless\nFramework users. The core Serverless\nFramework CLI and deployment\nfunctionality are not affected. The\nvulnerability is caused by the unsanitized\nuse of input parameters within a call to\nchild_process.exec, enabling an attacker to\ninject arbitrary system commands.\nSuccessful exploitation can lead to remote\ncode execution under the server process's\nprivileges. The server constructs and\nexecutes shell commands using\nunvalidated user input...\n2 \u2022 20:09", "creation_timestamp": "2026-05-22T13:10:03.000000Z"}, {"uuid": "6dc422f4-2b49-49d0-9dc9-0d32234cb04b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-69256", "type": "published-proof-of-concept", "source": "https://github.com/serverless/serverless/security/advisories/GHSA-rwc2-f344-q6w6", "content": "", "creation_timestamp": "2025-12-30T18:16:51.000000Z"}, {"uuid": "bc9281fe-f14a-4e2a-bf41-6391ba513a1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-69256", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/86450", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a mcp-stdio-shellguard\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a studiomeyer-io\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a TypeScript\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-29 20:51:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDefense-in-depth bundle for MCP stdio servers: drop-in guardExec/guardSpawn wrappers, AST audit CLI, reference MCP server. Closes the Ox-Security 200k-server stdio-RCE class (LiteLLM CVE-2025-69256). MIT, TypeScript, Node >= 20.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-29T21:06:27.000000Z"}, {"uuid": "f34efd90-b1f2-4489-8ff9-bea2a0ee7b68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-69256", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/387", "content": "CVE-2025-69256\n\nThe Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build applications. Starting in version 4.29.0 and prior to version 4.29.3, a command injection vulnerability exists in the Serverless Framework's built-in MCP server package (@serverless/mcp). This vulnerability only affects users of the experimental MCP server feature (serverless mcp), which represents less than 0.1% of Serverless Framework users. The core Serverless Framework CLI and deployment functionality are not affected. The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. The server constructs and executes shell commands using unvalidated user input...", "creation_timestamp": "2026-08-28T00:00:31.874215Z"}, {"uuid": "fa84f936-258d-43f3-a201-4379eb67c9f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-69256", "type": "seen", "source": "https://t.me/cve0day/387", "content": "CVE-2025-69256\n\nThe Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build applications. Starting in version 4.29.0 and prior to version 4.29.3, a command injection vulnerability exists in the Serverless Framework's built-in MCP server package (@serverless/mcp). This vulnerability only affects users of the experimental MCP server feature (serverless mcp), which represents less than 0.1% of Serverless Framework users. The core Serverless Framework CLI and deployment functionality are not affected. The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. The server constructs and executes shell commands using unvalidated user input...", "creation_timestamp": "2026-08-27T15:00:08.245402Z"}, {"uuid": "1bcc9711-347e-4150-9248-5de39b2b623f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-69256", "type": "seen", "source": "https://t.me/hacking_Attack/191303", "content": "mcp-stdio-shellguard v0.1.2\n\nDefense-in-depth bundle for MCP stdio servers: drop-in guardExec/guardSpawn wrappers, AST audit CLI, reference MCP server. Closes the Ox-Security 200k-server stdio-RCE class (LiteLLM CVE-2025-69256). MIT, TypeScript, Node >= 20.\nRead more...", "creation_timestamp": "2026-09-01T20:00:05.204245Z"}, {"uuid": "2be485c7-6c1b-40af-a657-2ccac91a691b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-69256", "type": "seen", "source": "https://t.me/hacking_Attack/191309", "content": "mcp-stdio-shellguard v0.1.2\nhttps://kitploit.com/en/posts/github-studiomeyer-io-mcp-stdio-shellguard-v012\n\nDefense-in-depth bundle for MCP stdio servers: drop-in guardExec/guardSpawn wrappers, AST audit CLI, reference MCP server. Closes the Ox-Security 200k-server stdio-RCE class (LiteLLM CVE-2025-69256). MIT, TypeScript, Node >= 20.", "creation_timestamp": "2026-09-01T20:00:05.243007Z"}, {"uuid": "2cc5a9f9-fbb1-4dec-a221-52cd3f59926b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-69256", "type": "seen", "source": "https://t.me/hacking_Attack/191142", "content": "mcp-server-attestation v0.2.0\nhttps://kitploit.com/en/posts/github-studiomeyer-io-mcp-server-attestation-v020\n\nLayer-2 supply-chain hardening for MCP servers \u2014 Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer. Defends against marketplace-poisoning + CVE-2025-69256 + CVE-2025-61591.", "creation_timestamp": "2026-09-01T20:00:05.675812Z"}, {"uuid": "acf5f5a9-1655-49f9-8df2-1f2c2f613b5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-69256", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/191309", "content": "mcp-stdio-shellguard v0.1.2\nhttps://kitploit.com/en/posts/github-studiomeyer-io-mcp-stdio-shellguard-v012\n\nDefense-in-depth bundle for MCP stdio servers: drop-in guardExec/guardSpawn wrappers, AST audit CLI, reference MCP server. Closes the Ox-Security 200k-server stdio-RCE class (LiteLLM CVE-2025-69256). MIT, TypeScript, Node >= 20.", "creation_timestamp": "2026-09-02T01:00:26.103490Z"}, {"uuid": "4d01a280-d236-4b50-9be6-557a291f5454", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-69256", "type": "seen", "source": "https://t.me/hacking_Attack/191303", "content": "mcp-stdio-shellguard v0.1.2\n\nDefense-in-depth bundle for MCP stdio servers: drop-in guardExec/guardSpawn wrappers, AST audit CLI, reference MCP server. Closes the Ox-Security 200k-server stdio-RCE class (LiteLLM CVE-2025-69256). MIT, TypeScript, Node >= 20.\nRead more...", "creation_timestamp": "2026-09-02T01:00:26.155256Z"}, {"uuid": "c096a89d-a4e1-4a62-aeab-febfc6c39ef1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-69256", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/191142", "content": "mcp-server-attestation v0.2.0\nhttps://kitploit.com/en/posts/github-studiomeyer-io-mcp-server-attestation-v020\n\nLayer-2 supply-chain hardening for MCP servers \u2014 Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer. Defends against marketplace-poisoning + CVE-2025-69256 + CVE-2025-61591.", "creation_timestamp": "2026-09-02T01:00:25.718219Z"}]}