CVE-2026-4199

A vulnerability was identified in bazinga012 mcp_code_executor up to 0.3.0. Affected by this issue is the function installDependencies of the file src/index.ts. Such manipulation leads to command injection. The attack can only be performed from a local environment. The exploit is publicly available and might be used. It is best practice to apply a patch to resolve this issue. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-74
• CWE-77

• https://github.com/bazinga012/mcp_code_executor/
• https://github.com/bazinga012/mcp_code_executor/issues/17
• https://github.com/bazinga012/mcp_code_executor/pull/18/commits/a94ec2fea318597646ba1c44d8e44eb1c9196d20
• https://github.com/user-attachments/files/25931133/mcp_code_executor_security_advisory.pdf
• https://vuldb.com/?ctiid.351111
• https://vuldb.com/?id.351111
• https://vuldb.com/?submit.770424

Published

Mar 16, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41984UAF vulnerability in the package management module. Impact: …5.2
• CVE-2026-41985UAF vulnerability in the package management module. Impact: …5.1
• CVE-2026-41986Logic bypass vulnerability in the file system. Impact: Succe…2.4
• CVE-2026-41987Permission control vulnerability in the app management modul…6.2
• CVE-2026-41988uuid before 14.0.0 can make unexpected writes when external …2.5
• CVE-2026-41989Libgcrypt before 1.12.2 sometimes allows a heap-based buffer…6.7
• CVE-2026-41990Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes…4
• CVE-2026-41991GNU gzip contains a vulnerability in the gzexe utility relat…4.7
• CVE-2026-41992GNU gzip contains a global buffer overflow vulnerability in …7.5
• CVE-2026-41993Improper Access Control vulnerability in the Removable Media…6.7
• CVE-2026-41999Incorrect Behaviour of Views with TCP PROXY Requests4.8
• CVE-2026-4200A security flaw has been discovered in glowxq glowxq-oj up t…7.3