PT-2026-6671 · Isaacwasserman · Mcp-Vegalite-Server

Lexpl0It · Published 2026-02-06 · Updated 2026-02-06 · CVE-2026-1977

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions isaacwasserman mcp-vegalite-server versions prior to 16aefed598b8cd897b78e99b907f6e2984572c61

Description A security issue exists in the eval function of the visualize data component. Manipulation of the vegalite specification argument can lead to code injection. This attack can be initiated remotely. The exploit for this issue has been publicly disclosed.

Recommendations Versions prior to 16aefed598b8cd897b78e99b907f6e2984572c61 should be updated. As a temporary workaround, consider restricting or disabling the use of the visualize data component until a suitable update is available. Avoid using the vegalite specification parameter in the affected function eval() until the issue is resolved.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2026-1977

Affected Products

Mcp-Vegalite-Server

References · 8

• 🔥 https://github.com/isaacwasserman/mcp-vegalite-server/issues/9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1977 · Security Note
• https://twitter.com/CVEnew/status/2019618719094505915 · Twitter Post
• https://vuldb.com/?ctiid.344499 · Note
• https://github.com/isaacwasserman/mcp-vegalite-server · Note
• https://t.me/CVEtracker/43889 · Telegram Post
• https://vuldb.com/?submit.743246 · Note
• https://vuldb.com/?id.344499 · Note