{"id":"CVE-2026-25905","aliases":["PYSEC-2026-2628"],"url":"https://o3.security/vulnerability/CVE-2026-25905","summary":"MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability","details":"### Impact\n**Critical Sandbox Escape & Server Takeover:**\nA critical security vulnerability exists in `mcp-run-python` due to a lack of isolation between the Python runtime (Pyodide) and the host JavaScript environment.\n\nThe `runPython` and `runPythonAsync` functions execute Python code using Pyodide without restricting access to the JavaScript bridge. This allows any executed Python code—whether from a user or an AI model—to access the `js` module in Pyodide. Through this bridge, the Python code can modify the global JavaScript environment, interact with the Node.js process, and alter the behavior of the MCP server.\n\n**Specific Attack Vector: MCP Tool Shadowing**\nBecause the Python code can modify the JS runtime, an attacker can dynamically overwrite or \"shadow\" existing MCP tools registered on the server. For example, an attacker could replace a secure file-reading tool with a malicious version that exfiltrates data to an external server, all while the MCP server appears to be functioning normally.\n\n### Patches\n**No Patch Available:**\nThe `mcp-run-python` project is currently **archived** and maintainers have indicated it is unlikely to receive a fix.\n\n**Recommendation:**\nUsers are strongly advised to **immediately stop using** this package.\nIf functionality is required, users must migrate to a maintained alternative that implements proper sandboxing (e.g., running Python in a Docker container or a restricted WASM environment with the JS bridge disabled).\n\n### Workarounds\nThere are no configuration-based workarounds. Securing the environment requires modifying the source code to disable the Pyodide-to-JS bridge or moving the execution environment to a fully isolated sandbox (e.g., a separate container).\n\n### Resources\n* [CVE-2026-25905](https://nvd.nist.gov/vuln/detail/CVE-2026-25905)\n* [JFrog Security Analysis: MCP Takeover](https://research.jfrog.com/vulnerabilities/mcp-run-python-lack-of-isolation-mcp-takeover-jfsa-2026-001653030)","published":"2026-02-09T09:30:22Z","modified":"2026-07-13T16:43:32.124942614Z","cvss":{"score":5.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"mcp-run-python","fixedVersion":null}],"fix":null,"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25905"},{"type":"PACKAGE","url":"https://github.com/pydantic/mcp-run-python"},{"type":"WEB","url":"https://research.jfrog.com/vulnerabilities/mcp-run-python-lack-of-isolation-mcp-takeover-jfsa-2026-001653030"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-13T16:43:32.124942614Z"}}