What’s Vulnerable › Vulnerabilities

CVE-2026-44717: MCP Calculate Server: Prompt Injection to RCE

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-15 · updated 2026-10-26
• Weakness: CWE-94

Description

MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library. Prior to 0.1.1, the use of eval() to evaluate mathematical expressions without proper input sanitization leads to remote code execution. This vulnerability is fixed in 0.1.1.

Affected products

• 611711Dark mcp_calculate_server: before 0.1.1

References

• https://github.com/611711Dark/mcp_calculate_server/security/advisories/GHSA-2mgq-7rfg-rwpj

Get alerted when CVE-2026-44717 or the next vulnerability affects your stack