MCPHub CVE-2025-11285

Exploitation requires an authenticated session or valid authentication credentials to access MCPHub endpoints. The vulnerable functionality is triggered specifically when the command or args parameters in serverController.ts are manipulated with OS command syntax (e.g., semicolons, pipes, backticks, command substitution). No special non-default configuration is mentioned in the description, suggesting the vulnerability exists in standard deployments. The attack vector is network-based, meaning remote access to the MCPHub service is required. Exploitation is limited to users with authentication capabilities (PR:L in CVSS), preventing unauthenticated remote exploitation. The low scope and impact (VC:L/VI:L/VA:L with SC:N) suggest that while command execution is possible, the actual damage is constrained by the process privileges and scope rules of the CVSS model.

The risk profile reveals significant discrepancy between scoring metrics. CVSS 2.1 is exceptionally low, driven by CVSS:4.0 vector requiring PR:L (low privilege authenticated user) and limited impact scope (VC:L/VI:L/VA:L with SC:N/SI:N/SA:N). However, EPSS at 0.25th percentile (49%) and publicly available POC indicate this is not a widespread exploitation concern in practice. The authentic risk depends heavily on deployment context: if MCPHub is exposed in trusted environments where authenticated users are expected to be benign, real-world impact is minimal; if deployed with weak authentication or in multi-tenant scenarios, risk escalates significantly. The vendor's non-response and low EPSS exploitation probability suggest limited threat actor interest despite public POC availability. The attack requires network access and authentication, establishing a moderate barrier compared to unauthenticated RCE vulnerabilities.

An authenticated user with legitimate access to MCPHub (e.g., a developer or admin account) crafts a malicious HTTP request to the vulnerable endpoint in serverController.ts, injecting shell metacharacters into the command or args field. The server executes the injected commands with the privileges of the MCPHub process, allowing the attacker to read sensitive files, create reverse shells, or modify application behavior. Given the publicly available POC in the referenced GitHub issue, exploitation is straightforward for any user with authentication credentials.