@justice8096/sagemath-mcp-server CVE-2026-106763

Requires the vulnerable @justice8096/sagemath-mcp-server version 1.0.1 to be deployed and to process attacker-supplied code/input that is routed through the sanitization path. Exploitation depends on user or agent interaction (UI:R) to pass the malicious input to the tool and on a payload specifically crafted to bypass the escapeShellString and sanitizeCode functions (AC:H). Limiting factors that reduce realistic risk: mandatory user interaction, high attack complexity, and the product's very small install base; the trigger beyond 'insufficient sanitization in escapeShellString/sanitizeCode' is not further detailed in the available sources.

Signals are mixed and lean toward moderate real-world priority despite the 7.5 (High) base score. The CVSS vector supplied by MITRE shows AV:N and PR:N (remote, no authentication) but is tempered by AC:H (a payload must be crafted to defeat the escapeShellString and sanitizeCode filters) and UI:R (an operator or agent must route the malicious input through the tool), which materially lowers the score from what an AV:N/AC:L/UI:N RCE would carry. No EPSS score is provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and there is no confirmed active exploitation - only a vuln.today 'this_week' decision label. A GitHub issue reference is present but is not verified as working exploit code, so POC status is best treated as a public PoC reference rather than confirmed exploit code. The dominant risk-reducing factor is prevalence: this is an obscure single-author npm MCP server with a negligible install base, so even full RCE represents a narrow, opportunistic exposure rather than a widespread threat. Net: a legitimately high-severity code-execution flaw on affected hosts, but low aggregate risk due to tiny footprint, required user interaction, and high attack complexity.

An attacker crafts SageMath code or input containing shell metacharacters designed to slip past the escapeShellString and sanitizeCode routines; when the MCP server (driven by an operator or LLM agent) processes that input, the injected commands execute on the host with the server's privileges. A GitHub issue reference exists describing the flaw but is not verified as working exploit code, and success requires both user interaction (UI:R) and a payload tailored to evade the filters (AC:H).