Threats Tagged 'cve-2026-25904'

CVE-2026-25904 is a Server-Side Request Forgery (SSRF) vulnerability in the Pydantic-AI MCP Run Python tool, which uses an overly permissive Deno sandbox configuration. This misconfiguration allows Python code executed within the sandbox to access the localhost interface of the host system, potentially enabling SSRF attacks. The project is archived and unlikely to receive a fix, increasing risk for users who continue to rely on it. The vulnerability has a CVSS score of 5.8 (medium severity), reflecting moderate impact and exploitation complexity. Exploitation requires user interaction but no privileges or authentication. While no known exploits are currently in the wild, the vulnerability could allow attackers to access internal services, leading to information disclosure and limited integrity and availability impacts. European organizations using this tool or similar configurations should be cautious, especially those in countries with strong adoption of Python and Deno-based development environments. Mitigation involves discontinuing use of the vulnerable tool, isolating sandbox environments, and restricting network access from sandboxed code. Countries with significant tech sectors and software development communities, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.

MediumVulnerabilityGermanyFranceNetherlands+3#cve#cve-2026-25904#cwe-918