A command injection vulnerability in the Serverless Framework MCP server component exposes affected systems to remote code execution risks.

This flaw involves the improper neutralization of special elements used in a command (CWE-77). It occurs within the @serverless/mcp package when processing input parameters in the list-projects tool, where unvalidated user input is passed directly to the child_process.exec function.

The vulnerability allows an attacker to execute arbitrary system commands with the privileges of the server process. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to the integrity and confidentiality of the affected build environments. Successful exploitation could lead to full system compromise, unauthorized data access, or the deployment of malicious code into cloud infrastructure.

Immediate Action: Update the Serverless Framework to version 4.29.3 or later to include the necessary input sanitization patches.

Proactive Monitoring: Review system and application logs for suspicious shell commands or unexpected process spawning originating from the Serverless MCP server service.

Compensating Controls: If immediate patching is not feasible, disable the experimental MCP server feature entirely to eliminate the attack vector.

Public Exploit Available: Yes, multiple public proofs-of-concept are available on GitHub.

While this vulnerability specifically impacts the experimental MCP feature, the risk of remote code execution is severe for those who have enabled it. Administrators should prioritize updating to version 4.29.3 immediately to secure their development and deployment pipelines. If the MCP feature is not required, it should be disabled as a best practice to reduce the overall attack surface.