CVE-2026-19958

MEDIUM 6.3

iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injection

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A security flaw has been discovered in iatsiuk pptr-mcp up to 0.2.7. The impacted element is the function executeCode of the file src/vm-executor.ts of the component execute Tool. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-94 CWE-74
Vendor	iatsiuk
Product	pptr-mcp
Published	Aug 16, 2026

Stay Ahead of the Next One

Get instant alerts for iatsiuk pptr-mcp

Be the first to know when new medium vulnerabilities affecting iatsiuk pptr-mcp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

iatsiuk / pptr-mcp

0.2.0 0.2.1 0.2.2 0.2.3 0.2.4 0.2.5 0.2.6 0.2.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/391135 vuldb.com: https://vuldb.com/vuln/391135/cti vuldb.com: https://vuldb.com/cve/CVE-2026-19958 vuldb.com: https://vuldb.com/submit/872830 github.com: http://github.com/iatsiuk/pptr-mcp/issues/1

Credits

🔍 TianyuLi (VulDB User) VulDB CNA Team