MCP Calculate Server: Prompt Injection to RCE

MCP Calculate Server uses an unsafe function (eval) to process mathematical expressions without checking them first, allowing attackers to run any code on the server by injecting malicious commands disguised as math problems.

The vulnerability stems from unsanitized use of eval() to evaluate user-supplied mathematical expressions, enabling arbitrary code execution through prompt injection. An unauthenticated remote attacker can craft a malicious input that breaks out of the mathematical evaluation context to execute system commands with server privileges. This CWE-94 (improper control of generation of code) combined with CWE-1427 (uncontrolled generation of code generation) results in complete system compromise.