CVE-2026-5029

Description

A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint without authentication on port 3088. An unauthenticated remote attacker can invoke the run-code MCP tool to supply arbitrary source code and execute it via child_process.exec() using the specified language interpreter. This allows execution of arbitrary code with the privileges of the user running the server. This vulnerability has not been fixed and might affect the project in all versions.

PUBLISHED Reserved 2026-03-27 | Published 2026-05-12 | Updated 2026-05-12 | Assigner CERT-PL

Problem types

CWE-306 Missing Authentication for Critical Function

Product status

Credits

Eryk Winiarz finder

References

cert.pl/en/posts/2026/05/CVE-2026-5029 third-party-advisory

cve.org (CVE-2026-5029)

nvd.nist.gov (CVE-2026-5029)

Download JSON