npm/@justice8096/sagemath-mcp-server CVE-2026-106763: high 7.5, EPSS 0.50%

@justice8096/sagemath-mcp-server: executes arbitrary code via the escapeShellString and sanitizeCode functions

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-2vq3-mpmf-9xgr
• https://nvd.nist.gov/vuln/detail/CVE-2026-106763
• https://github.com/justice8096/sagemath-mcp-server/issues/1
• https://github.com/justice8096/sagemath-mcp-server
• https://stillosdigitalholdings.com/advisories/CVE-2026-106763.cve.json
• https://www.npmjs.com/package/@justice8096/sagemath-mcp-server

CVE-2026-106763 · published 2026-10-23T15:31:39Z · modified 2026-10-29T21:15:03.450757595Z · JSON