Vulnerability-Lookup

CVE-2026-25904 (GCVE-0-2026-25904)

Vulnerability from cvelistv5 – Published: 2026-02-09 08:51 – Updated: 2026-02-09 14:04

Title

Overly permissive Deno configuration in mcp-run-python leads to SSRF

Summary

The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the "mcp-run-python" project is archived and unlikely to receive a fix.

Severity ?

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

JFROG

References

URL

Tags

https://research.jfrog.com/vulnerabilities/mcp-ru…

Impacted products

	Vendor	Product	Version
			Affected: 0 (python)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25904",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-09T14:02:22.527691Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-09T14:04:04.176Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org/project/pip",
          "packageName": "mcp-run-python",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the \"mcp-run-python\" project is archived and unlikely to receive a fix.\u003c/p\u003e"
            }
          ],
          "value": "The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the \"mcp-run-python\" project is archived and unlikely to receive a fix."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-09T08:51:18.196Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "url": "https://research.jfrog.com/vulnerabilities/mcp-run-python-deno-ssrf-jfsa-2026-001653029/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Overly permissive Deno configuration in mcp-run-python leads to SSRF"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-25904",
    "datePublished": "2026-02-09T08:51:18.196Z",
    "dateReserved": "2026-02-08T11:19:42.864Z",
    "dateUpdated": "2026-02-09T14:04:04.176Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-25904\",\"sourceIdentifier\":\"reefs@jfrog.com\",\"published\":\"2026-02-09T09:16:33.850\",\"lastModified\":\"2026-02-09T16:08:35.290\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the \\\"mcp-run-python\\\" project is archived and unlikely to receive a fix.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"reefs@jfrog.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L\",\"baseScore\":5.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.6,\"impactScore\":3.7}]},\"weaknesses\":[{\"source\":\"reefs@jfrog.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]}],\"references\":[{\"url\":\"https://research.jfrog.com/vulnerabilities/mcp-run-python-deno-ssrf-jfsa-2026-001653029/\",\"source\":\"reefs@jfrog.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-25904\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-09T14:02:22.527691Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-09T14:03:39.564Z\"}}], \"cna\": {\"title\": \"Overly permissive Deno configuration in mcp-run-python leads to SSRF\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 5.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"python\"}], \"packageName\": \"mcp-run-python\", \"collectionURL\": \"https://pypi.org/project/pip\"}], \"references\": [{\"url\": \"https://research.jfrog.com/vulnerabilities/mcp-run-python-deno-ssrf-jfsa-2026-001653029/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the \\\"mcp-run-python\\\" project is archived and unlikely to receive a fix.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the \\\"mcp-run-python\\\" project is archived and unlikely to receive a fix.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-918\", \"description\": \"CWE-918 Server-Side Request Forgery (SSRF)\"}]}], \"providerMetadata\": {\"orgId\": \"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d\", \"shortName\": \"JFROG\", \"dateUpdated\": \"2026-02-09T08:51:18.196Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-25904\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-09T14:04:04.176Z\", \"dateReserved\": \"2026-02-08T11:19:42.864Z\", \"assignerOrgId\": \"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d\", \"datePublished\": \"2026-02-09T08:51:18.196Z\", \"assignerShortName\": \"JFROG\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-6FGP-M6Q4-J3Q5

Vulnerability from github – Published: 2026-02-09 09:30 – Updated: 2026-02-11 19:47

Summary

MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access

Details

Impact

Server-Side Request Forgery (SSRF): A security vulnerability exists in the mcp-run-python tool (specifically within the Pydantic-AI integration) due to an overly permissive Deno sandbox configuration.

The tool configures the Deno runtime—which is intended to isolate the execution of untrusted Python code—with network permissions that include access to the host's loopback interface (localhost). Consequently, malicious Python code executed through the tool can bypass network isolation and send HTTP requests to internal services running on the host machine. This allows attackers to interact with local APIs, databases, or cloud metadata services that should not be accessible from the sandbox.

Patches

No Patch Available: The mcp-run-python project is currently archived and maintainers have indicated it is unlikely to receive a fix.

Recommendation: Users are strongly advised to immediately stop using this package. If functionality is required, users must migrate to an alternative execution environment that enforces strict network isolation (e.g., blocking all outbound traffic or explicitly denying access to 127.0.0.1/::1).

Workarounds

There are no configuration-based workarounds provided by the package itself. Remediation requires modifying the source code to restrict the Deno permissions (specifically removing or narrowing the --allow-net flag) or moving the execution to a container with no network access.

Resources

Severity ?

5.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mcp-run-python"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25904"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-11T19:47:51Z",
    "nvd_published_at": "2026-02-09T09:16:33Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n**Server-Side Request Forgery (SSRF):**\nA security vulnerability exists in the `mcp-run-python` tool (specifically within the Pydantic-AI integration) due to an overly permissive Deno sandbox configuration.\n\nThe tool configures the Deno runtime\u2014which is intended to isolate the execution of untrusted Python code\u2014with network permissions that include access to the host\u0027s loopback interface (`localhost`). Consequently, malicious Python code executed through the tool can bypass network isolation and send HTTP requests to internal services running on the host machine. This allows attackers to interact with local APIs, databases, or cloud metadata services that should not be accessible from the sandbox.\n\n### Patches\n**No Patch Available:**\nThe `mcp-run-python` project is currently **archived** and maintainers have indicated it is unlikely to receive a fix.\n\n**Recommendation:**\nUsers are strongly advised to **immediately stop using** this package.\nIf functionality is required, users must migrate to an alternative execution environment that enforces strict network isolation (e.g., blocking all outbound traffic or explicitly denying access to `127.0.0.1`/`::1`).\n\n### Workarounds\nThere are no configuration-based workarounds provided by the package itself. Remediation requires modifying the source code to restrict the Deno permissions (specifically removing or narrowing the `--allow-net` flag) or moving the execution to a container with no network access.\n\n### Resources\n* [CVE-2026-25904](https://nvd.nist.gov/vuln/detail/CVE-2026-25904)\n* [JFrog Security Analysis: Deno SSRF](https://research.jfrog.com/vulnerabilities/mcp-run-python-deno-ssrf-jfsa-2026-001653029)",
  "id": "GHSA-6fgp-m6q4-j3q5",
  "modified": "2026-02-11T19:47:51Z",
  "published": "2026-02-09T09:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25904"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pydantic/mcp-run-python"
    },
    {
      "type": "WEB",
      "url": "https://research.jfrog.com/vulnerabilities/mcp-run-python-deno-ssrf-jfsa-2026-001653029"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access"
}

FKIE_CVE-2026-25904

Vulnerability from fkie_nvd - Published: 2026-02-09 09:16 - Updated: 2026-02-09 16:08

Severity ?

5.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Summary

References

	URL	Tags
	reefs@jfrog.com	https://research.jfrog.com/vulnerabilities/mcp-run-python-deno-ssrf-jfsa-2026-001653029/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the \"mcp-run-python\" project is archived and unlikely to receive a fix."
    },
    {
      "lang": "es",
      "value": "La herramienta Pydantic-AI MCP Run Python configura el sandbox de Deno con una configuraci\u00f3n excesivamente permisiva que permite al c\u00f3digo Python subyacente acceder a la interfaz localhost del host para realizar ataques SSRF. Nota - el proyecto \u0027mcp-run-python\u0027 est\u00e1 archivado y es poco probable que reciba una soluci\u00f3n."
    }
  ],
  "id": "CVE-2026-25904",
  "lastModified": "2026-02-09T16:08:35.290",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.7,
        "source": "reefs@jfrog.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-09T09:16:33.850",
  "references": [
    {
      "source": "reefs@jfrog.com",
      "url": "https://research.jfrog.com/vulnerabilities/mcp-run-python-deno-ssrf-jfsa-2026-001653029/"
    }
  ],
  "sourceIdentifier": "reefs@jfrog.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "reefs@jfrog.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-25904 (GCVE-0-2026-25904)

GHSA-6FGP-M6Q4-J3Q5

Impact

Patches

Workarounds

Resources

FKIE_CVE-2026-25904

Tags

Sightings

Nomenclature