CVE-2026-25905: mcp-run-python Critical Sandbox Escape & Server Takeover Vulnerability
Summary
CVE-2026-25905: MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability. Affects mcp-run-python versions < 0.0.22. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mcp-run-python package allows users to execute Python code within a JavaScript environment using Pyodide. It is designed to facilitate the integration of Python scripts into JavaScript applications. However, due to its lack of proper isolation between the Python runtime and the host JavaScript environment, it is vulnerable to critical security issues.
Vulnerability Detail
A critical security vulnerability exists in mcp-run-python due to insufficient isolation between the Python runtime (Pyodide) and the host JavaScript environment. The runPython and runPythonAsync functions execute Python code without restricting access to the JavaScript bridge, allowing executed Python code to access the js module in Pyodide. This can lead to a sandbox escape, enabling attackers to modify the global JavaScript environment, interact with the Node.js process, and alter the behavior of the MCP server. Attackers can overwrite existing MCP tools, potentially replacing secure tools with malicious versions that exfiltrate data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no configuration-based workarounds. Securing the environment requires modifying the source code to disable the Pyodide-to-JS bridge or moving the execution environment to a fully isolated sandbox, such as a separate container.
Conclusion
The mcp-run-python package has a critical vulnerability that allows for sandbox escape and server takeover due to insufficient isolation between the Python runtime and the JavaScript environment. Users are strongly advised to discontinue use of this package and migrate to safer alternatives.
See every vulnerability recorded for mcp-run-python →
FAQ
The vulnerability allows for a sandbox escape and server takeover due to a lack of isolation between the Python runtime and the JavaScript environment.
An attacker could exploit this vulnerability to modify your application's JavaScript environment, potentially leading to data exfiltration or unauthorized access to server functionalities.
No, there is currently no patch available as the mcp-run-python project is archived and unlikely to receive further updates.
You should immediately stop using the mcp-run-python package and migrate to a maintained alternative that provides proper sandboxing.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for mcp-run-python.
