Detections
Analytics

SCA: security update for serverless (GHSA-rwc2-f344-q6w6)

high Tenable Cloud Security Plugin ID 436532

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build
 applications. Starting in version 4.29.0 and prior to version 4.29.3, a command injection vulnerability
 exists in the Serverless Framework's built-in MCP server package (@serverless/mcp). This vulnerability
 only affects users of the experimental MCP server feature (serverless mcp), which represents less than
 0.1% of Serverless Framework users. The core Serverless Framework CLI and deployment functionality are not
 affected. The vulnerability is caused by the unsanitized use of input parameters within a call to
 `child_process.exec`, enabling an attacker to inject arbitrary system commands. Successful exploitation
 can lead to remote code execution under the server process's privileges. The server constructs and
 executes shell commands using unvalidated user input directly within command-line strings. This introduces
 the possibility of shell metacharacter injection (`|`, `>`, `&&`, etc.). Version 4.29.3 fixes the issue.
 (CVE-2025-69256)

See Also

https://github.com/advisories/GHSA-rwc2-f344-q6w6

Plugin Details

Severity: High

ID: 436532

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 1/1/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.02

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-69256

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/31/2025

Vulnerability Publication Date: 12/30/2025

Reference Information

CVE: CVE-2025-69256

cwe: CWE-77