{"cve":"CVE-2026-25905","nvd":{"published":"2026-02-09T09:16:34.030","modified":"2026-06-17T10:25:24.907","status":"Deferred","description":"The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any Python code to use the Pyodide APIs to modify the JS environment. This may result in an attacker hijacking the MCP server - for malicious purposes including MCP tool shadowing. Note - the \"mcp-run-python\" project is archived and unlikely to receive a fix.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L","score":5.8},"cwes":["CWE-653"],"references":["https://research.jfrog.com/vulnerabilities/mcp-run-python-lack-of-isolation-mcp-takeover-jfsa-2026-001653030/"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:22:27.261130201+00:00"},"epss":{"cve":"CVE-2026-25905","score":0.00207,"percentile":0.10773,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-pfv4-wmph-5gc6","url":"https://osv.dev/vulnerability/GHSA-pfv4-wmph-5gc6","summary":"MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability","modified":"2026-07-13T16:43:32.124942614Z","packages":[{"ecosystem":"PyPI","name":"mcp-run-python","purl":"pkg:pypi/mcp-run-python","ranges":["<=0.0.22"],"fixed":[]}]},{"id":"PYSEC-2026-2628","url":"https://osv.dev/vulnerability/PYSEC-2026-2628","summary":"MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability","modified":"2026-07-13T16:32:13.788582967Z","packages":[{"ecosystem":"PyPI","name":"mcp-run-python","purl":"pkg:pypi/mcp-run-python","ranges":["<=0.0.22"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}