MediumVulnerabilityLLM-specific
CVE-2025-52573: iOS Simulator MCP Server command injection through ui_tap tool
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2025-52573
- Published
- Record updated
- Affected
- ios-simulator-mcp < 1.3.3
- Fixed in
- 1.3.3
- released June 20, 2025, 6 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.7%
Summary
iOS Simulator MCP Server (ios-simulator-mcp) versions prior to 1.3.3 are vulnerable to command injection through the `ui_tap` tool, which passes LLM-supplied `duration`, `udid`, `x` and `y` arguments into Node.js `exec`. Shell meta-characters in these inputs, which prompt injection can induce, let an attacker run arbitrary commands on the host running the MCP server. Tracked as CVE-2025-52573.
Mitigation
Fixed in version 1.3.3, which contains a patch for the issue.
Topics
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
- InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database