CVE-2026-19964
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability was found in Jij-Inc Jij-MCP-Server 0.1.0. This affects the function PythonREPL.run of the file jij_mcp/python_repr.py of the jm_check component. Manipulation of the argument code results in code injection. The attack can be launched remotely, and the exploit has been made public.
Risk Assessment
The risk includes remote arbitrary code execution in the server context, which could lead to full system compromise or data breach.
Recommendation
It is recommended to immediately restrict access to the server and monitor for patches, as the project has not responded to the report.
Original NVD description (English source)
A vulnerability was found in Jij-Inc Jij-MCP-Server 0.1.0. This affects the function PythonREPL.run of the file jij_mcp/python_repr.py of the component jm_check. The manipulation of the argument code results in code injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.