CVE-2026-2008

abhiphile fermat-mcp eqn_chart.py eqn_chart code injection

State: Published
Severity: 5.3 Medium
Published: Feb 6, 2026
Updated: Feb 23, 2026
Reserved: Feb 5, 2026

Description

A vulnerability was detected in abhiphile fermat-mcp up to 47f11def1cd37e45dd060f30cdce346cbdbd6f0a. This vulnerability affects the function eqn_chart of the file fmcp/mpl_mcp/core/eqn_chart.py. Performing a manipulation of the argument equations results in code injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-94 Code Injection
CWE-74 Injection

Affected Products

Product	Versions
fermat-mcpabhiphile	47f11def1cd37e45dd060f30cdce346cbdbd6f0aAffected

References

VDB-344590 | abhiphile fermat-mcp eqn_chart.py eqn_chart code injectionvdb-entrytechnical-description
VDB-344590 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #743458 | GitHub fermat-mcp master Code Injectionthird-party-advisory
https://github.com/abhiphile/fermat-mcp/issues/9issue-tracking
https://github.com/abhiphile/fermat-mcp/issues/9#issue-3837794397exploitissue-tracking
https://github.com/abhiphile/fermat-mcp/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.