CVE-2026-25904 json
Overly permissive Deno configuration in mcp-run-python leads to SSRF
published 9mo ago modified 3mo ago also GHSA-6fgp-m6q4-j3q5 , PYSEC-2026-2627 , EUVD-2026-6603
- cvss
- 5.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 8%
- public exploits
- 0
- none known
Summary
The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the "mcp-run-python" project is archived and unlikely to receive a fix.
Is CVE-2026-25904 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 9mo ago
Exploit prediction
0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L |
| OSV | 3.1 | 5.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L |
| GitHub | 3.1 | 5.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | mcp-run-python | <=0.0.22 |
no fix listed |
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
- research.jfrog.com /vulnerabilities/mcp-run-python-deno-ssrf-jfsa-2026-001653029/
-
nvd.nist.gov
/vuln/detail/CVE-2026-25904
advisory
-
github.com
/pydantic/mcp-run-python
package
-
research.jfrog.com
/vulnerabilities/mcp-run-python-deno-ssrf-jfsa-2026-001653029
web
-
pypi.org
/project/mcp-run-python
package
-
github.com
/advisories/GHSA-6fgp-m6q4-j3q5
advisory
Sources
- CVE List CVE-2026-25904
- GitHub Advisory GHSA-6fgp-m6q4-j3q5
- NVD CVE-2026-25904
- OSV PYSEC-2026-2627
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.