Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.8
CVE-2026-25905: mcp-run-python allows Python code to take over server
CVE-2026-25905 · published 8 months ago
Summary
The mcp-run-python tool runs Python code without separating it from the surrounding JavaScript. This lets a malicious script change the server’s behavior and potentially control the MCP server. Because the project is no longer maintained, you should stop using it or replace it with a safer alternative that isolates code execution.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | samuel colvin | mcp-run-python | <= 0.0.22 |
Original advisory text
MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability
The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any Python code to use the Pyodide APIs to modify the JS environment. This may result in an attacker hijacking the MCP server - for malicious purposes including MCP tool shadowing. Note - the "mcp-run-python" project is archived and unlikely to receive a fix.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-653Improper Isolation or Compartmentalization
Timeline
Published9 Feb 2026
Updated29 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta