CVE-2026-25905
Lack of isolation in mcp-run-python leads to MCP server takeover
- State
- Published
- Severity
- 5.8 Medium
- Published
- Feb 9, 2026
- Updated
- Feb 9, 2026
- Reserved
- Feb 8, 2026
Description
The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any Python code to use the Pyodide APIs to modify the JS environment. This may result in an attacker hijacking the MCP server - for malicious purposes including MCP tool shadowing. Note - the "mcp-run-python" project is archived and unlikely to receive a fix.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.8 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L | JFROG |
Weaknesses
- CWE-653 Improper Isolation or Compartmentalization
Affected Products
| Product | Versions |
|---|---|
mcp-run-python |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.