@mastra/server@1.72.0
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe agent-builder workflow can execute supplied shell commands with the server environment, which is a risky capability even though its route requires authentication. The flagged credential flow is for the Vercel AI Gateway, and no install-time attack was found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An authenticated caller starts an agent-builder action run or stream.
Impact
A misused or compromised authorized workflow could run commands with the server account's permissions and access its environment.
Mechanism
The workflow tool accepts a command and working directory, then executes the command with the server process environment.
AI rationale
The agent-builder workflow can execute supplied shell commands with the server environment, which is a risky capability even though its route requires authentication. The flagged credential flow is for the Vercel AI Gateway, and no install-time attack was found.
Evidence
dist/server/handlers/agent-builder.jsdist/dist-CYk5xS3y.jspackage.json
Network endpoints2
POST /agent-builder/:actionId/create-runPOST /agent-builder/:actionId/stream
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with high false-positive risk.
Evidence for warning
- The agent-builder create-run route requires authentication and starts the selected workflow.
- The loaded agent-builder workflow exposes a shell tool that accepts a command and working directory.
- That tool runs the supplied command with the server process environment.
- The manifest has no install lifecycle hook; the flagged gateway provider sends its authentication token to the Vercel AI Gateway endpoint.
Evidence against
- The shell capability is part of an explicitly invoked, authenticated agent-builder workflow; no covert execution or malicious command was established.
- The gateway code uses the Vercel OIDC token or AI Gateway API key with the Vercel AI Gateway, which is consistent with that provider's purpose.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinified
Source & flagged code
6 flagged · loading sourcedist/dist-CRMvLG_8.cjsView file
31let async_hooks = require("async_hooks");
L32: let child_process = require("child_process");
L33: let fs_promises = require("fs/promises");
High
Child Process
Package source references child process execution.
dist/dist-CRMvLG_8.cjsView on unpkg · L3131Cross-file remote execution chain: dist/dist-CRMvLG_8.cjs spawns dist/dist-BQ0VOLA9.cjs; helper contains network access plus dynamic code execution.
L31: let async_hooks = require("async_hooks");
L32: let child_process = require("child_process");
L33: let fs_promises = require("fs/promises");
...
L712: }
L713: fetch(e, t = {}) {
L714: let i = W.hasSubscribers, { status: s = R() ? {} : void 0 } = t;
...
L4832: if (hasBuffer && Buffer.isBuffer(text)) text = text.toString();
L4833: if (text && text.charCodeAt(0) === 65279) text = text.slice(1);
L4834: const obj = JSON.parse(text, reviver);
...
L6537: type: "redacted_reasoning",
L6538: value: { data: value.data }
L6539: };
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/dist-CRMvLG_8.cjsView on unpkg · L31dist/schema-e0VHpMt0-BS9KHnuT.cjsView file
Findings
1 Critical5 High2 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/dist-CYk5xS3y.js
HighChild Processdist/dist-CRMvLG_8.cjs
HighShell
HighCredential Redirect Persistencedist/dist-CYk5xS3y.js
HighCross File Remote Execution Contextdist/dist-CRMvLG_8.cjs
HighSemantic Analysis Limiteddist/sync-BG15Yae1.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/schema-e0VHpMt0-BS9KHnuT.cjs
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @mastra/server@1.72.0.
See all versions of @mastra/server for other recorded verdicts.
- Review the evidence and your use of @mastra/server@1.72.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.