Threats Tagged 'cve-2026-25905'

CVE-2026-25905 is a medium severity vulnerability affecting the 'mcp-run-python' project, where Python code executed via 'runPython' or 'runPythonAsync' is not properly isolated from JavaScript code. This improper compartmentalization (CWE-653) allows Python code to manipulate the JavaScript environment through Pyodide APIs, potentially enabling an attacker to hijack the MCP server and perform malicious activities such as tool shadowing. The vulnerability has a CVSS score of 5.8, indicating moderate risk, with network attack vector, high attack complexity, no privileges required, and user interaction needed. The project is archived and unlikely to receive patches, increasing the risk for users still relying on it. There are no known exploits in the wild as of now. European organizations using this tool or similar environments integrating Python and JavaScript without proper isolation are at risk, especially those in critical infrastructure or software development sectors. Mitigation requires isolating Python execution environments, restricting Pyodide API access, or migrating away from the unmaintained project. Countries with strong software development ecosystems and critical infrastructure relying on such tools, including Germany, France, the UK, and the Netherlands, are more likely to be affected.

MediumVulnerabilityGermanyFranceNetherlands+3#cve#cve-2026-25905#cwe-653