What is the CVSS score of CVE-2025-53100?

CVE-2025-53100 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2025-53100?

Within 24 hours: Identify all systems running Codehooks.io MCP Server and document current versions. Within 7 days: Upgrade to version 0.2.2 or later on all affected instances and verify successful deployment. Within 30 days: Conduct access reviews for user accounts with MCP server access and implement network segmentation to restrict MCP server exposure.

CVE-2025-53100

EUVD-2025-19660 HIGH

OS Command Injection (CWE-78)

2025-07-01 security-advisories@github.com

Command Injection

8.6

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:35 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

0.2.2

EUVD ID Assigned

Mar 16, 2026 - 01:42 euvd

EUVD-2025-19660

Analysis Generated

Mar 16, 2026 - 01:42 vuln.today

CVE Published

Jul 01, 2025 - 18:15 nvd

HIGH 8.6

DescriptionGitHub Advisory

RestDB's Codehooks.io MCP Server is an MCP server on the Codehooks.io platform. Prior to version 0.2.2, the MCP server is written in a way that is vulnerable to command injection attacks as part of some of its MCP Server tools definition and implementation. This could result in a user initiated remote command injection attack on a running MCP Server. This issue has been patched in version 0.2.2.

Analysis

Technical ContextAI

Command injection allows an attacker to execute arbitrary OS commands on the host system through a vulnerable application that passes user input to system shells. This vulnerability is classified as OS Command Injection (CWE-78).

RemediationAI

Avoid passing user input to system commands. Use language-specific APIs instead of shell commands. If unavoidable, use strict input validation and escaping.