Zero Radar
← feed
HighVulnerabilityCVE-2026-106763updated 29 Oct 2026, 20:59 UTC

SageMath MCP server npm package can let attackers run code

A tool that lets AI assistants run SageMath math code could let an outside attacker run their own commands on the machine it runs on. The safety checks meant to block this are not strong enough.

Official, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends inputCrafted input reaches the MCP server
  2. 2Sanitizer failsescapeShellString and sanitizeCode miss malicious content
  3. 3Shell command runsInjected code executes on the host
  4. ResultAttacker runs code on the server

What happened

In @justice8096/sagemath-mcp-server, the escapeShellString and sanitizeCode functions fail to properly neutralize input, allowing remote arbitrary code execution (CVSS 7.5, high).

Why it is dangerous: An attacker who can send crafted input to the server may execute arbitrary code with the server's privileges, potentially taking over the host. Anyone running this package with untrusted input is at risk.

Are you affected?

You are affected if you run the npm package @justice8096/sagemath-mcp-server at version 1.0.1 or earlier and it accepts input from untrusted sources.

Package / productAffected versionsFixed in
@justice8096/sagemath-mcp-server · npm<= 1.0.1no fix yet

What to do

  1. Check whether you use @justice8096/sagemath-mcp-server and which version is installed.
  2. Check the GitHub advisory GHSA-2vq3-mpmf-9xgr or the npm page for a fixed version and update when one is released.
  3. Until a fix is available, stop exposing the server to untrusted users or networks and run it with minimal privileges.

Timeline

  1. 23 Oct 2026, 15:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 15:17 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 20:59 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-106763 · GHSA-2vq3-mpmf-9xgr
CVSS
7.5 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 15:17 UTC
On Zero Radar
before the radar started
Last change
29 Oct 2026, 20:59 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

SageMath MCP server npm package can let attackers run code · Zero Radar