Command Injection Vulnerability in Lara Translate MCP Server by Translated

CVE-2025-53832

What is CVE-2025-53832?

The Lara Translate MCP Server contains a command injection vulnerability that stems from the insecure handling of user input within the @translated/lara-mcp component. Specifically, versions 0.0.11 and below improperly validate input parameters when executing commands through child_process.exec. This flaw permits an attacker to inject arbitrary commands into the server's environment, potentially allowing for remote code execution with the same privileges as the server process. An update to version 0.0.12 resolves this critical security issue by implementing appropriate input sanitization, thereby mitigating the risk of exploitation.

References