CVE-2026-25905CWE-653

Lack of isolation in mcp-run-python leads to MCP server takeover

Medium · published February 9, 2026

CVSS v3.1
5.8
EPSS
0%
Percentile
14.2
In the wild
Unconfirmed
What it is

The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any Python code to use the Pyodide APIs to modify the JS environment. This may result in an attacker hijacking the MCP server - for malicious purposes including MCP tool shadowing. Note - the "mcp-run-python" project is archived and unlikely to receive a fix.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00239 · 14.2th percentile
Weakness
CWE-653 · Improper Isolation or Compartmentalization
Published
2026-02-09T09:01Z
EPSS history
Timeline
  • 09 FEB 09:01Z
    Lack of isolation in mcp-run-python leads to MCP server takeover
    cvelistv5