What’s Vulnerable › Vulnerabilities

CVE-2026-4199: bazinga012 mcp_code_executor index.ts installDependencies command injection

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-16 · updated 2026-06-17
• Weakness: CWE-74

Description

A vulnerability was identified in bazinga012 mcp_code_executor up to 0.3.0. Affected by this issue is the function installDependencies of the file src/index.ts. Such manipulation leads to command injection. The attack can only be performed from a local environment. The exploit is publicly available and might be used. It is best practice to apply a patch to resolve this issue. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

• bazinga012 mcp_code_executor: 0.1, 0.2, 0.3.0

References

• https://github.com/bazinga012/mcp_code_executor/
• https://github.com/bazinga012/mcp_code_executor/issues/17
• https://github.com/bazinga012/mcp_code_executor/pull/18/commits/a94ec2fea318597646ba1c44d8e44eb1c9196d20
• https://github.com/user-attachments/files/25931133/mcp_code_executor_security_advisory.pdf
• https://vuldb.com/?ctiid.351111
• https://vuldb.com/?id.351111
• https://vuldb.com/?submit.770424

Get alerted when CVE-2026-4199 or the next vulnerability affects your stack