CVE-2026-19964: Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injection
A vulnerability was found in Jij-Inc Jij-MCP-Server 0.1.0. This affects the function PythonREPL.run of the file jijmcp/pythonrepr.py of the component jmcheck. The manipulation of the argument code results in code injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19964?
CVE-2026-19964 has a medium severity score of 5.5.
What components are affected by CVE-2026-19964?
CVE-2026-19964 affects the PythonREPL.run function in the jij_mcp/python_repr.py file of the Jij-Inc Jij-MCP-Server.
How does the code injection vulnerability in CVE-2026-19964 work?
CVE-2026-19964 involves manipulating the 'code' argument in the PythonREPL.run function to execute arbitrary code.
How can I mitigate CVE-2026-19964?
To mitigate CVE-2026-19964, ensure that input to the PythonREPL.run function is properly sanitized to prevent code injection.
Is CVE-2026-19964 exploitable remotely?
Yes, CVE-2026-19964 can be exploited remotely due to its nature of code injection.