CVE-2025-53372

Name of the Vulnerable Software and Affected Versions: node-code-sandbox-mcp versions prior to 1.3.0

Description: The issue is caused by the unsanitized use of input parameters within a call to child process.execSync, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges on the host machine, bypassing the sandbox protection of running code inside Docker.

Recommendations: For versions prior to 1.3.0, update to version 1.3.0 to resolve the issue. As a temporary workaround, consider restricting the use of the child process.execSync function to minimize the risk of exploitation.