Which versions of Mcp Code Executor are affected by CVE-2026-4199?

Organizations using bazinga012 mcp_code_executor should be aware of moderate risk from CVE-2026-4199, a command injection vulnerability rated CVSS 5.3.. A patch is available.

Is there a public PoC exploit available for CVE-2026-4199?

Yes, a public proof-of-concept exploit is available for CVE-2026-4199. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-4199?

Within 30 days: Identify affected systems running bazinga012 mcp_code_executor and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Mcp Code Executor CVE-2026-4199

Q: What is the CVSS score of CVE-2026-4199?

CVE-2026-4199 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-12269 LOW

Command Injection (CWE-77)

2026-03-16 VulDB

Command Injection Mcp Code Executor

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.8 (MEDIUM) 1.9 (LOW)

CVSS changed

Apr 22, 2026 - 21:37 NVD

5.3 (MEDIUM) 4.8 (MEDIUM)

PoC Detected

Mar 16, 2026 - 14:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 16, 2026 - 01:00 euvd

EUVD-2026-12269

Analysis Generated

Mar 16, 2026 - 01:00 vuln.today

Patch released

Mar 16, 2026 - 01:00 nvd

Patch available

CVE Published

Mar 16, 2026 - 00:02 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in bazinga012 mcp_code_executor up to 0.3.0. Affected by this issue is the function installDependencies of the file src/index.ts. Such manipulation leads to command injection. The attack can only be performed from a local environment. The exploit is publicly available and might be used. It is best practice to apply a patch to resolve this issue. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Command injection in bazinga012 mcp_code_executor up to version 0.3.0 allows local attackers with user-level privileges to execute arbitrary commands through the installDependencies function in src/index.ts. Public exploit code exists for this vulnerability, affecting Python and Node.js environments. A patch is available and should be applied to remediate this local privilege escalation risk.

Technical ContextAI

The mcp_code_executor is a Model Context Protocol code execution utility that programmatically manages package dependencies. The vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), which represents failures in command injection prevention. The installDependencies function in src/index.ts directly processes user-controlled input without proper escaping or parameterization before passing it to shell execution contexts, allowing attackers to inject arbitrary shell metacharacters and commands. The affected product is identified through CPE identifier patterns related to the bazinga012 mcp_code_executor package across versions 0.1.0 through 0.3.0.

RemediationAI

Immediately cease usage of mcp_code_executor versions 0.3.0 and earlier until a patched version is released. Monitor the official bazinga012 mcp_code_executor repository for security updates and apply the patch version once available. As interim protective measures, restrict execution of the installDependencies function to trusted, isolated execution contexts with minimal privilege, disable local code execution features if not required, implement strict input validation on any user-controllable parameters passed to the function, and run the tool in containerized environments with resource limits and user privilege separation to restrict the blast radius of command injection exploitation. For organizations awaiting a patch, consider using an alternative dependency management solution or implementing a wrapper script that validates and sanitizes all input before passing it to the mcp_code_executor.