CVE-2026-44717criticalCWE-1427CWE-94

CVE-2026-44717: critical vulnerability in 611711Dark mcp_calculate_server

MCP Calculate Server: Prompt Injection to RCE

Published

Follow this CVE+ Monitor mcp calculate server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.5%
In short

MCP Calculate Server uses an unsafe function (eval) to process mathematical expressions without checking them first, allowing attackers to run any code on the server by injecting malicious commands disguised as math problems.

Technical detail

The vulnerability stems from unsanitized use of eval() to evaluate user-supplied mathematical expressions, enabling arbitrary code execution through prompt injection. An unauthenticated remote attacker can craft a malicious input that breaks out of the mathematical evaluation context to execute system commands with server privileges. This CWE-94 (improper control of generation of code) combined with CWE-1427 (uncontrolled generation of code generation) results in complete system compromise.

Summary generated and translated by AI from the official description.
MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library. Prior to 0.1.1, the use of eval() to evaluate mathematical expressions without proper input sanitization leads to remote code execution. This vulnerability is fixed in 0.1.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
611711Dark · mcp_calculate_server