CVE-2026-25904
Medium · 5.8CVSS
5.8
EPSS
0.2%
Published
Feb 9, 2026
CISA due date
—
The record
The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the "mcp-run-python" project is archived and unlikely to receive a fix.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | mcp-run-python | 0 | No fix |
Related vulnerabilities
- GHSA-6fgp-m6q4-j3q5 MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access Same vulnerability
- GHSA-pfv4-wmph-5gc6 MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability Also affects mcp-run-python
- CVE-2026-25905 The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the… Also affects mcp-run-python
- CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a… CWE-918
- CVE-2026-87953 Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider… CWE-918
- CVE-2026-114634 WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in… CWE-918
- CVE-2026-112288 Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that… CWE-918
- CVE-2026-111936 Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability… CWE-918