{"id":"CVE-2026-106763","kind":"vulnerability","aliases":["CVE-2026-106763"],"related":[],"title":"SageMath MCP server: shell escaping flaw lets remote attackers run code","description":"An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.","summary":"The @justice8096/sagemath-mcp-server 1.0.1 npm package has a flaw in its escapeShellString and sanitizeCode functions that lets a remote attacker execute arbitrary code. The sources do not say whether the attacker needs any prior access or what input path reaches those functions.","severity":"high","cvss":7.5,"epss":0.00699,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","mcp","node","npm","sagemath"],"not_affected_if":["package-not-installed"],"how_to_check":"- Run `npm ls @justice8096/sagemath-mcp-server` in each project to see whether version `1.0.1` is installed\n- Check whether the server is exposed to any network the attacker can reach, which the sources do not confirm","fix":"- Upgrade `@justice8096/sagemath-mcp-server` past `1.0.1`; the sources do not name a fixed version\n- Remove the package if no fixed release is available","status":"open","published_at":"2026-10-23T15:17:23+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:14:52+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-10-25T03:14:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `@justice8096/sagemath-mcp-server` past `1.0.1`; the sources do not name a fixed version\n- Remove the package if no fixed release is available","reach":"unknown","title":"SageMath MCP server: shell escaping flaw lets remote attackers run code","impact":"high","summary":"The @justice8096/sagemath-mcp-server 1.0.1 npm package has a flaw in its escapeShellString and sanitizeCode functions that lets a remote attacker execute arbitrary code. The sources do not say whether the attacker needs any prior access or what input path reaches those functions.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","node","npm","sagemath"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote attacker runs arbitrary code on the server hosting the MCP","analyst_note":"Find the advisory or repository commit that names the fixed version and the exact input path reaching escapeShellString and sanitizeCode (https://nvd.nist.gov/vuln/detail/CVE-2026-106763).","how_to_check":"- Run `npm ls @justice8096/sagemath-mcp-server` in each project to see whether version `1.0.1` is installed\n- Check whether the server is exposed to any network the attacker can reach, which the sources do not confirm","needs_analyst":true,"not_affected_if":["package-not-installed"],"who_is_affected":"Teams running the @justice8096/sagemath-mcp-server package at version 1.0.1 are affected, most likely where an MCP client passes input to the SageMath code path. Teams that do not use this package can skip it. Whether it is reachable over a network is unknown from the sources.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000645,"input_tokens":3289,"output_tokens":632,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-106763':14A,17A '-2026':13A,16A '1.0.1':27B,70C 'access':58B 'ai':19B 'ai-tool':18B 'allow':71C 'arbitrari':45B,77C 'attack':9A,43B,54B,74C 'code':11A,46B,78C 'cve':12A,15A 'escap':5A 'escapeshellstr':35B,81C 'execut':44B,76C 'flaw':6A,32B 'function':38B,65B,84C 'input':61B 'issu':67C 'justice8096/sagemath-mcp-server':26B,69C 'let':7A,40B 'mcp':2A,21B 'need':55B 'node':22B 'npm':23B,28B 'packag':29B 'path':62B 'prior':57B 'reach':63B 'remot':8A,42B,73C 'run':10A 'sagemath':1A,24B 'sanitizecod':37B,83C 'say':51B 'server':3A 'shell':4A 'sourc':48B 'tool':20B 'via':79C 'whether':52B","nicknames":[],"mitigations":[],"who_affected":"Teams running the @justice8096/sagemath-mcp-server package at version 1.0.1 are affected, most likely where an MCP client passes input to the SageMath code path. Teams that do not use this package can skip it. Whether it is reachable over a network is unknown from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106763","severity":null,"published_at":"2026-10-23T15:17:23+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-106763","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106763","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}