Low
samanhappy MCPHub serverController.ts os command injection
Type: advisorySources: OSV
A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController.ts. The manipulation of the argument command/args results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-11285
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 01:23 UTC · Revision 1
Source evidence
samanhappy MCPHub serverController.ts os command injection
core-osv · Original sourcePublished 5 Oct 2025, 06:02 UTC
A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController.ts. The manipulation of the argument command/args results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
osv:CVE-2025-11285
Complete source record
{
"id": "585ad7acf65dcff813ff576174cbf4445c9648a391d968dc17b63e0dd4a67957",
"url": "https://osv.dev/vulnerability/CVE-2025-11285",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "samanhappy MCPHub serverController.ts os command injection",
"summary": "A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController.ts. The manipulation of the argument command/args results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"evidence": "osv:CVE-2025-11285",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2025-11285",
"aliases": [
"CVE-2025-11285",
"GHSA-5q2p-3jg8-2m98"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/samanhappy/mcphub",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "7685b9bca8ceb8e3526988b135165c0733107de9"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:mcphubx:mcphub:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "0.9.10"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v0.9.10",
"v0.9.9",
"v0.9.8",
"v0.9.7",
"v0.9.6",
"v0.9.5",
"v0.9.4",
"v0.9.3",
"v0.9.2",
"v0.9.1",
"v0.9.0",
"v0.8.7",
"v0.8.6",
"v0.8.5",
"v0.8.4",
"v0.8.3",
"v0.8.2",
"v0.8.1",
"v0.8.0",
"v0.7.7",
"v0.7.6",
"v0.7.5",
"v0.7.4",
"v0.7.3",
"v0.7.2",
"v0.7.1",
"v0.7.0",
"v0.6.2",
"v0.6.1",
"v0.6.0",
"v0.5.4",
"v0.5.3",
"v0.5.2",
"v0.5.1",
"v0.5.0",
"v0.4.3",
"v0.4.2",
"v0.4.1",
"v0.4.0",
"v0.3.8",
"v0.3.7",
"v0.3.6",
"v0.3.5",
"v0.3.4",
"v0.3.3",
"v0.3.2",
"v0.3.1",
"v0.3.0",
"v0.2.0",
"v0.1.1",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11285.json"
}
}
],
"modified": "2026-10-28T02:30:24.756841101Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11285.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-11285",
"https://vuldb.com/?id.327043",
"https://vuldb.com/?submit.659734",
"https://github.com/August829/YU1/issues/6",
"https://vuldb.com/?ctiid.327043"
],
"provider_metadata": {
"cwe_ids": [
"CWE-77",
"CWE-78"
],
"cna_assigner": "VulDB",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "0.9.0"
},
{
"last_affected": "0.9.0"
},
{
"introduced": "0.9.1"
},
{
"last_affected": "0.9.1"
},
{
"introduced": "0.9.2"
},
{
"last_affected": "0.9.2"
},
{
"introduced": "0.9.3"
},
{
"last_affected": "0.9.3"
},
{
"introduced": "0.9.4"
},
{
"last_affected": "0.9.4"
},
{
"introduced": "0.9.5"
},
{
"last_affected": "0.9.5"
},
{
"introduced": "0.9.6"
},
{
"last_affected": "0.9.6"
},
{
"introduced": "0.9.7"
},
{
"last_affected": "0.9.7"
},
{
"introduced": "0.9.8"
},
{
"last_affected": "0.9.8"
},
{
"introduced": "0.9.9"
},
{
"last_affected": "0.9.9"
},
{
"introduced": "0.9.10"
},
{
"last_affected": "0.9.10"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
}
]
},
{
"extracted_events": [
{
"range": [
{
"last_affected": "0.9.10"
}
],
"source": "DESCRIPTION"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11285.json"
}
},
"related_cves": [
{
"value": "CVE-2025-11285",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 491561,
"published_at": "2025-10-05T06:02:06.272+00:00"
}