Homepage

mcp-run-python@0.0.21 vulnerabilities

Model Context Protocol server to run Python code in a sandbox.

  • latest version

    0.0.22

  • first published

    5 months ago

  • latest version published

    2 months ago

  • licenses detected

  • View mcp-run-python package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the mcp-run-python package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • L
    Server-side Request Forgery (SSRF)

    mcp-run-python is a Model Context Protocol server to run Python code in a sandbox.

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to an overly permissive configuration of the Deno sandbox, which allows access to the localhost interface. An attacker can access internal network resources by executing crafted Python code.

    How to fix Server-side Request Forgery (SSRF)?

    There is no fixed version for mcp-run-python.

    [0,)
    • L
    Improper Isolation or Compartmentalization

    mcp-run-python is a Model Context Protocol server to run Python code in a sandbox.

    Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization via the runPython or runPythonAsync functions. An attacker can gain unauthorized access to and manipulate the server environment by executing arbitrary Python code that interacts with the JavaScript context.

    How to fix Improper Isolation or Compartmentalization?

    There is no fixed version for mcp-run-python.

    [0,)
    Go back to all versions of this package