CVE-2025-53100CWE-78

RestDB's Codehooks.io MCP Server Vulnerable to Command Injection

High · published July 1, 2025

CVSS v4.0
8.6
EPSS
1%
Percentile
69.3
In the wild
Unconfirmed
What it is

RestDB's Codehooks.io MCP Server is an MCP server on the Codehooks.io platform. Prior to version 0.2.2, the MCP server is written in a way that is vulnerable to command injection attacks as part of some of its MCP Server tools definition and implementation. This could result in a user initiated remote command injection attack on a running MCP Server. This issue has been patched in version 0.2.2.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01256 · 69.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-07-01T17:49Z
EPSS history
Timeline
  • 01 JUL 17:49Z
    RestDB's Codehooks.io MCP Server Vulnerable to Command Injection
    cvelistv5