Paper/Archive/CVE-2026-44717

CVE-2026-44717

611711Dark mcp_calculate_server — MCP Calculate Server: Prompt Injection to RCE

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 41.3.413 × 208.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library. Prior to 0.1.1, the use of eval() to evaluate mathematical expressions without proper input sanitization leads to remote code execution. This vulnerability is fixed in 0.1.1.

Affected

ProductAffectedFixed inSource

mcp_calculate_server< 0.1.1–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/611711Dark/mcp_calculate_server/security/advisories/GHSA-2mgq-7rfg-rwpj