The mcp_calculate_server product versions before 0.1.1 improperly use Python's eval() function to process input expressions without adequate sanitization, resulting in CWE-94: Improper Control of Generation of Code (Code Injection). This flaw enables remote attackers to execute arbitrary code, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity. The vendor fixed the issue in version 0.1.1 by removing or securing the use of eval(). No cloud service is involved, and no official remediation level is specified beyond the version update.

Successful exploitation of this vulnerability allows remote, unauthenticated attackers to execute arbitrary code on the server running vulnerable versions of mcp_calculate_server. This can lead to full system compromise, including data theft, modification, or service disruption. The CVSS score of 9.8 reflects the high impact on confidentiality, integrity, and availability.

Upgrade mcp_calculate_server to version 0.1.1 or later, where the vulnerability is fixed. Since the vendor advisory confirms the fix in 0.1.1, applying this update is the primary and recommended remediation. There is no indication of alternative mitigations or temporary workarounds.