CVE-2026-25905
Medium · 5.8CVSS
5.8
EPSS
0.2%
Published
Feb 9, 2026
CISA due date
—
The record
The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any Python code to use the Pyodide APIs to modify the JS environment. This may result in an attacker hijacking the MCP server - for malicious purposes including MCP tool shadowing. Note - the "mcp-run-python" project is archived and unlikely to receive a fix.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | mcp-run-python | 0 | No fix |
Related vulnerabilities
- GHSA-pfv4-wmph-5gc6 MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability Same vulnerability
- GHSA-6fgp-m6q4-j3q5 MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access Also affects mcp-run-python
- CVE-2026-25904 The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive… Also affects mcp-run-python
- CVE-2026-15366 A control logic defect in a specific built-in webpage of Kids Mode allows users to view… CWE-653
- CVE-2026-62246 Kamaji is the Hosted Control Plane Manager for Kubernetes. CWE-653
- GHSA-gqmf-56h7-rrpf npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware… CWE-653
- CVE-2026-41155 An attacker could cooperatively pass data from one secure GPU process to another secure… CWE-653
- CVE-2026-42782 Improper Isolation or Compartmentalization vulnerability in Apache Syncope. CWE-653