CVE-2026-106763: High severity npm/@justice8096/sagemath-mcp-server vulnerability

Published Oct 23, 2026

Updated

An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.

Affected Software

1 affected component

npm/@justice8096/sagemath-mcp-server=1.0.1

Event History

Oct 23, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverity

Frequently Asked Questions

Does exploitation require an authenticated account?

No privileges are required. The reported vector is network-based, but exploitation requires user interaction and has high attack complexity.

Which package version is identified as affected?

The issue is reported in @justice8096/sagemath-mcp-server version 1.0.1.

What is the potential impact if exploitation succeeds?

A remote attacker may execute arbitrary code. The severity vector indicates high confidentiality, integrity, and availability impact.

CVE-2026-106763: High severity npm/@justice8096/sagemath-mcp-server vulnerability

Affected Software

Event History

Frequently Asked Questions

Does exploitation require an authenticated account?

Which package version is identified as affected?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require an authenticated account?

Which package version is identified as affected?

What is the potential impact if exploitation succeeds?