joshuayoes ios-simulator-mcp up to 1.3.2 ui_tap os command injection

Summaryinfo

A vulnerability classified as critical was found in joshuayoes ios-simulator-mcp up to 1.3.2. This affects the function ui_tap. The manipulation results in os command injection. This vulnerability is reported as CVE-2025-52573. The attack requires a local approach. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in joshuayoes ios-simulator-mcp up to 1.3.2. Affected is the function ui_tap. The manipulation with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

iOS Simulator MCP Server (ios-simulator-mcp) is a Model Context Protocol (MCP) server for interacting with iOS simulators. Versions prior to 1.3.3 are written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. The MCP Server exposes the tool `ui_tap` which relies on Node.js child process API `exec` which is an unsafe and vulnerable API if concatenated with untrusted user input. LLM exposed user input for `duration`, `udid`, and `x` and `y` args can be replaced with shell meta-characters like `;` or `&&` or others to change the behavior from running the expected command `idb` to another command. When LLMs are tricked through prompt injection (and other techniques and attack vectors) to call the tool with input that uses special shell characters such as `; rm -rf /tmp;#` and other payload variations, the full command-line text will be interepted by the shell and result in other commands except of `ps` executing on the host running the MCP Server. Version 1.3.3 contains a patch for the issue.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-52573 since 06/18/2025. The exploitability is told to be difficult. The attack needs to be approached locally. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading to version 1.3.3 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch eb53a4f2cc8bbeb13e8d6d930f00167befcdb809 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-19229). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• joshuayoes

Name

• ios-simulator-mcp

Version

• 1.3.0
• 1.3.1
• 1.3.2

License

• open-source

Website

• Product: https://github.com/joshuayoes/ios-simulator-mcp/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion