Executive brief
Code Runner MCP Server is a tool used to execute code snippets via the Model Context Protocol. A security flaw allows anyone with network access to the server to run any command or code they want without needing a password. This could lead to a complete takeover of the system where the server is running, potentially exposing sensitive data or allowing further attacks on the internal network.
Technical details
A remote code execution (RCE) vulnerability exists in the Code Runner MCP Server due to missing authentication (CWE-306) on its JSON-RPC endpoint. When the server is started with the '--transport http' flag, it exposes the '/mcp' endpoint on port 3088 without any authorization requirements. An attacker on the adjacent network can send a crafted JSON-RPC request to the 'run-code' tool. The server processes this request using 'child_process.exec()', executing the provided source code with the privileges of the server process. As of the advisory date, no patch is available, and all versions are considered vulnerable.
Affected products
- Code Runner MCP Server project Code Runner MCP Server All versions
Timeline
- 2026-05-12: disclosed: Vulnerability disclosed by CERT Polska
- 2026-05-12: advisory