PT-2026-6671 · Isaacwasserman · Mcp-Vegalite-Server

Lexpl0It · Publicado 2026-02-06 · Atualizado 2026-02-06 · CVE-2026-1977

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions isaacwasserman mcp-vegalite-server versions prior to 16aefed598b8cd897b78e99b907f6e2984572c61

Description A security issue exists in the eval function of the visualize data component. Manipulation of the vegalite specification argument can lead to code injection. This attack can be initiated remotely. The exploit for this issue has been publicly disclosed.

Recommendations Versions prior to 16aefed598b8cd897b78e99b907f6e2984572c61 should be updated. As a temporary workaround, consider restricting or disabling the use of the visualize data component until a suitable update is available. Avoid using the vegalite specification parameter in the affected function eval() until the issue is resolved.

Exploit

Correção

Special Elements Injection

Code Injection

Enumeração de Fraquezas

CWE-74

CWE-94

Identificadores relacionados

CVE-2026-1977

Produtos afetados

Mcp-Vegalite-Server

Referências · 8

• 🔥 https://github.com/isaacwasserman/mcp-vegalite-server/issues/9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1977 · Nota de Segurança
• https://twitter.com/CVEnew/status/2019618719094505915 · Publicação no Twitter
• https://vuldb.com/?ctiid.344499 · Nota
• https://github.com/isaacwasserman/mcp-vegalite-server · Nota
• https://t.me/CVEtracker/43889 · Publicação no Telegram
• https://vuldb.com/?submit.743246 · Nota
• https://vuldb.com/?id.344499 · Nota