Threats tagged 'ghsa-h4jc-wm4j-2vrp'

A command injection vulnerability in MCP Data Science Server 0.1.6 allows unauthenticated attackers to execute arbitrary Python code via the safe_eval() function. This occurs because the function uses Python's exec() without restricting the __builtins__ dictionary, granting access to powerful built-in functions. Exploitation can lead to complete system compromise.