CVE-2026-25904 json
Overly permissive Deno configuration in mcp-run-python leads to SSRF
published 2026-02-09 8 mo ago modified 2026-07-13 3 mo ago also GHSA-6fgp-m6q4-j3q5 , PYSEC-2026-2627 , EUVD-2026-6603
- cvss
- 5.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 8%
- public exploits
- 0
- none known
Summary
The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the "mcp-run-python" project is archived and unlikely to receive a fix.
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L |
| OSV | 3.1 | 5.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L |
| GitHub | 3.1 | 5.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | mcp-run-python | <=0.0.22 |
no fix listed |
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
- research.jfrog.com /vulnerabilities/mcp-run-python-deno-ssrf-jfsa-2026-001653029/
-
nvd.nist.gov
/vuln/detail/CVE-2026-25904
advisory
-
github.com
/pydantic/mcp-run-python
package
-
research.jfrog.com
/vulnerabilities/mcp-run-python-deno-ssrf-jfsa-2026-001653029
web
-
pypi.org
/project/mcp-run-python
package
-
github.com
/advisories/GHSA-6fgp-m6q4-j3q5
advisory
Sources
- CVE List CVE-2026-25904
- GitHub Advisory GHSA-6fgp-m6q4-j3q5
- NVD CVE-2026-25904
- OSV PYSEC-2026-2627
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.