AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2026-25905

MEDIUM · CVSS 5.8 EPSS 0.18%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2026-02-09 · Last synced 2026-08-04

CyberRota Analysis

This is a medium severity vulnerability with a CVSS score of 5.8. See the original NVD description below for full technical details.

CVE
CVE-2026-25905
Severity
MEDIUM
CVSS
5.8
EPSS
0.18%

Original NVD Description

The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any Python code to use the Pyodide APIs to modify the JS environment. This may result in an attacker hijacking the MCP server - for malicious purposes including MCP tool shadowing. Note - the "mcp-run-python" project is archived and unlikely to receive a fix.