Command Injection Vulnerability in Lara Translate MCP Server by Translated
CVE-2025-53832

7.5HIGH

Key Information:

Vendor

Translated

Status
Lara-mcp
Vendor
CVE Published:
21 July 2025

What is CVE-2025-53832?

The Lara Translate MCP Server contains a command injection vulnerability that stems from the insecure handling of user input within the @translated/lara-mcp component. Specifically, versions 0.0.11 and below improperly validate input parameters when executing commands through child_process.exec. This flaw permits an attacker to inject arbitrary commands into the server's environment, potentially allowing for remote code execution with the same privileges as the server process. An update to version 0.0.12 resolves this critical security issue by implementing appropriate input sanitization, thereby mitigating the risk of exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

lara-mcp < 0.0.12

References

https://github.com/translated/lara-mcp/security/advisorie...
x_refsource_CONFIRM
https://github.com/translated/lara-mcp/commit/e534ef690ad...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.