CVE-2026-4199
bazinga012 mcp_code_executor index.ts installDependencies command injection
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was identified in bazinga012 mcp_code_executor up to 0.3.0. Affected by this issue is the function installDependencies of the file src/index.ts. Such manipulation leads to command injection. The attack can only be performed from a local environment. The exploit is publicly available and might be used. It is best practice to apply a patch to resolve this issue. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-77 CWE-74 |
| Vendor | bazinga012 |
| Product | mcp_code_executor |
| Published | Mar 16, 2026 |
| Last Updated | Mar 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for bazinga012 mcp_code_executor
Be the first to know when new medium vulnerabilities affecting bazinga012 mcp_code_executor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
bazinga012 / mcp_code_executor
0.1 0.2 0.3.0
References
vuldb.com: https://vuldb.com/?id.351111 vuldb.com: https://vuldb.com/?ctiid.351111 vuldb.com: https://vuldb.com/?submit.770424 github.com: https://github.com/bazinga012/mcp_code_executor/issues/17 github.com: https://github.com/user-attachments/files/25931133/mcp_code_executor_security_advisory.pdf github.com: https://github.com/bazinga012/mcp_code_executor/pull/18/commits/a94ec2fea318597646ba1c44d8e44eb1c9196d20 github.com: https://github.com/bazinga012/mcp_code_executor/
Credits
🔍 Yinci Chen (VulDB User)