CVE-2026-25904

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25904", "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "state": "PUBLISHED", "assignerShortName": "JFROG", "dateReserved": "2026-02-08T11:19:42.864Z", "datePublished": "2026-02-09T08:51:18.196Z", "dateUpdated": "2026-02-09T14:04:04.176Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://pypi.org/project/pip", "packageName": "mcp-run-python", "versions": [{"status": "affected", "version": "0", "versionType": "python"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the \"mcp-run-python\" project is archived and unlikely to receive a fix.</p>"}], "value": "The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the \"mcp-run-python\" project is archived and unlikely to receive a fix."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "shortName": "JFROG", "dateUpdated": "2026-02-09T08:51:18.196Z"}, "references": [{"url": "https://research.jfrog.com/vulnerabilities/mcp-run-python-deno-ssrf-jfsa-2026-001653029/"}], "source": {"discovery": "EXTERNAL"}, "title": "Overly permissive Deno configuration in mcp-run-python leads to SSRF"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T14:02:22.527691Z", "id": "CVE-2026-25904", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T14:04:04.176Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25904", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T14:02:22.527691Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T14:03:39.564Z"}}], "cna": {"title": "Overly permissive Deno configuration in mcp-run-python leads to SSRF", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"versions": [{"status": "affected", "version": "0", "versionType": "python"}], "packageName": "mcp-run-python", "collectionURL": "https://pypi.org/project/pip"}], "references": [{"url": "https://research.jfrog.com/vulnerabilities/mcp-run-python-deno-ssrf-jfsa-2026-001653029/"}], "descriptions": [{"lang": "en", "value": "The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the \"mcp-run-python\" project is archived and unlikely to receive a fix.", "supportingMedia": [{"type": "text/html", "value": "<p>The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the \"mcp-run-python\" project is archived and unlikely to receive a fix.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "shortName": "JFROG", "dateUpdated": "2026-02-09T08:51:18.196Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25904", "state": "PUBLISHED", "dateUpdated": "2026-02-09T14:04:04.176Z", "dateReserved": "2026-02-08T11:19:42.864Z", "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "datePublished": "2026-02-09T08:51:18.196Z", "assignerShortName": "JFROG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.org/project/pip", "packageName": "mcp-run-python", "versions": [{"status": "affected", "version": "0", "versionType": "python"}]}], "source": "reefs@jfrog.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the \"mcp-run-python\" project is archived and unlikely to receive a fix."}, {"lang": "es", "value": "La herramienta Pydantic-AI MCP Run Python configura el sandbox de Deno con una configuraci\u00f3n excesivamente permisiva que permite al c\u00f3digo Python subyacente acceder a la interfaz localhost del host para realizar ataques SSRF. Nota - el proyecto 'mcp-run-python' est\u00e1 archivado y es poco probable que reciba una soluci\u00f3n."}], "id": "CVE-2026-25904", "lastModified": "2026-06-17T10:25:24.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.7, "source": "reefs@jfrog.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25904", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-09T14:02:22.527691Z", "version": "2.0.3"}}]}, "published": "2026-02-09T09:16:33.850", "references": [{"source": "reefs@jfrog.com", "url": "https://research.jfrog.com/vulnerabilities/mcp-run-python-deno-ssrf-jfsa-2026-001653029/"}], "sourceIdentifier": "reefs@jfrog.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "reefs@jfrog.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "product": "mcp-run-python", "vendor": "pydantic-ai"}], "analysis": {"en": {"generated_at": "2026-04-18T13:05:59.743801+00:00", "value": {"mitigation_remediation": ["Reconfigure the Deno sandbox to deny network access to the localhost interface or restrict it to only required external domains", "Remove or deprecate the mcp\u2011run\u2011python tool from active environments, since the project is archived", "Implement network monitoring to detect unexpected HTTP requests originating from the Deno sandbox to internal services"], "summary": {"action": "Apply Workaround", "impact": "Server Side Request Forgery (SSRF)"}, "threat_synthesis": {"affected_systems": "Pydantic\u2011AI mcp\u2011run\u2011python, an archived project with no maintained updates or patch releases. No specific release versions are documented, and the tool remains unchanged since its last activity.", "description_and_impact": "The vulnerability results from an overly permissive Deno sandbox configuration in the Pydantic\u2011AI mcp\u2011run\u2011python tool. Python code executed inside the sandbox is granted unrestricted access to the localhost network interface of the host machine. This allows an attacker to issue internal HTTP requests from the tool, effectively enabling server\u2011side request forgery. The flaw could let an adversary probe internal services, exfiltrate data, or pivot to additional targets within the host, as the code runs with local privileges.", "risk_and_exploitability": "The CVSS score of 5.8 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires an attacker to run malicious Python code that the mcp\u2011run\u2011python sandbox executes; from that position the attacker can send arbitrary requests to the host\u2019s localhost interface. Because the project is archived and unlikely to receive a fix, the risk must be mitigated through configuration changes or by discontinuing use of the tool."}}}}, "created": "2026-02-10T15:37:38.960707+00:00", "updated": "2026-04-18T13:15:25.709259+00:00", "vendors": ["pydantic-ai", "pydantic-ai$PRODUCT$mcp-run-python"]}