CVE-2026-25904: mcp-run-python Package Misconfiguration Leads to SSRF Vulnerability
Summary
CVE-2026-25904: MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access. Affects mcp-run-python versions < 0.0.22. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mcp-run-python package is a tool designed to execute Python code within a Deno runtime environment, providing a layer of isolation for untrusted code. It integrates with Pydantic-AI, allowing users to run Python scripts while attempting to maintain security through sandboxing. However, due to a misconfiguration in the Deno sandbox, the package inadvertently permits access to the host's loopback interface, creating a significant security risk.
Vulnerability Detail
The vulnerability arises from an overly permissive Deno sandbox configuration in the mcp-run-python tool. This misconfiguration allows malicious Python code to bypass network isolation and send HTTP requests to internal services on the host machine, potentially exposing sensitive APIs, databases, or cloud metadata services to unauthorized access. The vulnerability is classified as Server-Side Request Forgery (SSRF), which can lead to data breaches and unauthorized interactions with local resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no configuration-based workarounds provided by the package itself. To remediate the issue, users must modify the source code to restrict Deno permissions by removing or narrowing the --allow-net flag. Alternatively, consider executing the code in a container with no network access.
Conclusion
The mcp-run-python package has a significant vulnerability due to a misconfiguration in its Deno sandbox, allowing for SSRF attacks. Users are strongly advised to discontinue use of the package and seek alternatives that provide better security. With no patch available, immediate action is necessary to protect sensitive internal resources.
See every vulnerability recorded for mcp-run-python →
FAQ
Server-Side Request Forgery (SSRF) is a security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources.
If your application uses the mcp-run-python package, it may allow attackers to access sensitive internal services, leading to potential data breaches.
No, the mcp-run-python project is archived, and maintainers have indicated that it is unlikely to receive a fix.
You should immediately stop using the mcp-run-python package and migrate to an alternative that enforces strict network isolation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for mcp-run-python.
