Which versions of Code Runner MCP Server are affected by EUVD-2026-29437?

Code Runner MCP Server contains a remote code execution flaw allowing unauthenticated attackers with adjacent-network access to execute arbitrary commands as the server's user when deployed with HTTP…

How to fix or mitigate EUVD-2026-29437?

Within 24 hours: Perform inventory of all Code Runner MCP Server deployments, identify instances using --transport http flag, and document network accessibility and running user privileges. Within 7 days: Restrict network access to port 3088 via firewall rules to only authorized clients; disable HTTP transport if operationally feasible or proxy the endpoint behind an authentication layer (API gateway with mTLS or reverse proxy requiring authentication). Within 30 days: Monitor vendor advisory channels for patch release; conduct cost-benefit analysis of alternative MCP implementations; implement runtime monitoring and alerting on unexpected child process spawning from the server process.

Code Runner MCP Server EUVD-2026-29437

Q: What is the CVSS score of EUVD-2026-29437?

EUVD-2026-29437 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-5029 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-05-12 CERT-PL

GHSA-jv4w-6p47-rhcx

Authentication Bypass RCE Code Runner Mcp Server

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Unauthenticated code-execution tool reachable without interaction gives PR:N/UI:N/AC:L; adjacent-only reach per the published vector sets AV:A, and direct exec yields full C/I/A:H.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:31 vuln.today

CVE Published

May 12, 2026 - 09:01 nvd

UNKNOWN (no severity yet)

CVE Published

May 12, 2026 - 09:01 cve.org

HIGH 8.7

DescriptionCVE.org

A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint without authentication on port 3088. An unauthenticated remote attacker can invoke the run-code MCP tool to supply arbitrary source code and execute it via child_process.exec() using the specified language interpreter. This allows execution of arbitrary code with the privileges of the user running the server. This vulnerability has not been fixed and might affect the project in all versions.

AnalysisAI

Remote code execution in Code Runner MCP Server (all versions) allows an unauthenticated attacker with adjacent-network access to run arbitrary commands when the server is launched with the --transport http option, which exposes an unauthenticated /mcp JSON-RPC endpoint on port 3088. Invoking the run-code tool passes attacker-supplied source to child_process.exec(), yielding code execution as the user running the server. This is a design-level missing-authentication flaw (CWE-306) with no public exploit identified at time of analysis; EPSS is low (0.05%) and it is not on CISA KEV.

Technical ContextAI

Code Runner MCP Server implements the Model Context Protocol (MCP), a JSON-RPC based protocol used to expose tools to AI/LLM agents. When started with --transport http, the server binds an HTTP JSON-RPC listener on port 3088 and, per the report, applies no authentication to the /mcp endpoint. Its core run-code tool is designed to accept a language identifier and source code and execute it by shelling out through Node.js child_process.exec() with the chosen interpreter - a code-execution primitive that is safe only behind a trust boundary. The root cause maps to CWE-306 (Missing Authentication for a Critical Function): a function that executes arbitrary code is reachable without any credential, so the intended-by-design code execution becomes an open RCE service. The affected product is identified by CPE cpe:2.3:a:code_runner_mcp_server:code_runner_mcp_server:*:*:*:*:*:*:*:* covering all versions.

RemediationAI

No vendor-released patch identified at time of analysis - the CERT-PL report states the issue is unfixed and may affect all versions, so remediation relies on compensating controls. The most effective control is to avoid the --transport http mode and run the server over a non-network transport (e.g., stdio) so no listening socket is exposed; this removes the attack surface but disables HTTP-based access for any client that depends on it. If HTTP transport is required, bind the listener to localhost (127.0.0.1) instead of all interfaces and block inbound access to port 3088 at the host/network firewall, restricting it to trusted local processes only - the trade-off is loss of remote MCP connectivity. Because the /mcp endpoint has no built-in authentication, place it behind an authenticating reverse proxy or mutual-TLS gateway if remote use is unavoidable, and treat the host as capable of arbitrary code execution by design. Monitor the CERT-PL advisory (https://cert.pl/en/posts/2026/05/CVE-2026-5029) and the project repository for a fixed release, and upgrade as soon as one is published.