Live › vulnerability › CVE-2026-106763
Go to dashboardThe @justice8096/sagemath-mcp-server 1.0.1 npm package has a flaw in its escapeShellString and sanitizeCode functions that lets a remote attacker execute arbitrary code. The sources do not say whether the attacker needs any prior access or what input path reaches those functions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running the @justice8096/sagemath-mcp-server package at version 1.0.1 are affected, most likely where an MCP client passes input to the SageMath code path. Teams that do not use this package can skip it. Whether it is reachable over a network is unknown from the sources.
No product ranges from the sources yet.
npm ls @justice8096/sagemath-mcp-server in each project to see whether version 1.0.1 is installed@justice8096/sagemath-mcp-server past 1.0.1; the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.
This page as .md · .json · in your agent: get_signal("CVE-2026-106763")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.