rohitg00/kubectl-mcp-server · Security
Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page
- GHSA ID
- GHSA-94gr-w3q5-rfqr
- CVE ID
- CVE-2025-65719
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim system via user interaction with a crafted HTML page.
CWEs
- CWE-94 · Improper Control of Generation of Code ('Code Injection')