{"id":"CVE-2026-25905","aliases":["GHSA-pfv4-wmph-5gc6","PYSEC-2026-2628"],"title":"MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability","summary":"MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability","severity":"medium","cvss":5.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L","vendor":"mcp-run-python","product":"mcp-run-python","ecosystem":"pip","affected":["mcp-run-python <= 0.0.22"],"published":"2026-02-09","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-pfv4-wmph-5gc6","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25905"},{"url":"https://github.com/pydantic/mcp-run-python"},{"url":"https://research.jfrog.com/vulnerabilities/mcp-run-python-lack-of-isolation-mcp-takeover-jfsa-2026-001653030"}],"tags":["osv","pip"],"epss":0.00184,"epssPercentile":0.08253,"ingestedAt":"2026-07-13T18:58:01.396Z","slug":"CVE-2026-25905","body":"## Overview\n\n### Impact\n**Critical Sandbox Escape & Server Takeover:**\nA critical security vulnerability exists in `mcp-run-python` due to a lack of isolation between the Python runtime (Pyodide) and the host JavaScript environment.\n\nThe `runPython` and `runPythonAsync` functions execute Python code using Pyodide without restricting access to the JavaScript bridge. This allows any executed Python code—whether from a user or an AI model—to access the `js` module in Pyodide. Through this bridge, the Python code can modify the global JavaScript environment, interact with the Node.js process, and alter the behavior of the MCP server.\n\n**Specific Attack Vector: MCP Tool Shadowing**\nBecause the Python code can modify the JS runtime, an attacker can dynamically overwrite or \"shadow\" existing MCP tools registered on the server. For example, an attacker could replace a secure file-reading tool with a malicious version that exfiltrates data to an external server, all while the MCP server appears to be functioning normally.\n\n### Patches\n**No Patch Available:**\nThe `mcp-run-python` project is currently **archived** and maintainers have indicated it is unlikely to receive a fix.\n\n**Recommendation:**\nUsers are strongly advised to **immediately stop using** this package.\nIf functionality is required, users must migrate to a maintained alternative that implements proper sandboxing (e.g., running Python in a Docker container or a restricted WASM environment with the JS bridge disabled).\n\n### Workarounds\nThere are no configuration-based workarounds. Securing the environment requires modifying the source code to disable the Pyodide-to-JS bridge or moving the execution environment to a fully isolated sandbox (e.g., a separate container).\n\n### Resources\n* [CVE-2026-25905](https://nvd.nist.gov/vuln/detail/CVE-2026-25905)\n* [JFrog Security Analysis: MCP Takeover](https://research.jfrog.com/vulnerabilities/mcp-run-python-lack-of-isolation-mcp-takeover-jfsa-2026-001653030)\n\n## Affected packages\n\n- `mcp-run-python <= 0.0.22`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":31.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}