Description

A vulnerability was found in Jij-Inc Jij-MCP-Server 0.1.0. This affects the function PythonREPL.run of the file jij_mcp/python_repr.py of the component jm_check. The manipulation of the argument code results in code injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-17T00:16:27.290Z",
  "pubdate": "2026-08-17T00:16:27.290Z",
  "executiveSummary": "A critical code injection vulnerability exists in the Jij-Inc Jij-MCP-Server 0.1.0 component, specifically within the PythonREPL.run function located in jij_mcp/python_repr.py. This security flaw allows malicious actors to execute arbitrary Python code remotely by manipulating the vulnerable code argument. The presence of a publicly available exploit, combined with the vendor's lack of response to early issue reports, significantly elevates the risk of active exploitation. The vulnerability exposes affected systems to severe compromise, enabling unauthorized remote attackers to execute system-level commands, manipulate local file systems, and potentially achieve full administrative control over the hosting environment. Successful exploitation requires network access to the vulnerable service and the ability to supply crafted input payloads to the insecure evaluation mechanism, bypassing standard input sanitization controls.",
  "technicalDetails": "The root cause of this vulnerability is the insecure evaluation and execution of user-supplied strings within the PythonREPL.run function of the jij_mcp/python_repr.py component. When processing input via the code argument, the application fails to properly sanitize, validate, or restrict the execution context, passing untrusted input directly into a Python Read-Eval-Print Loop or an underlying execution evaluation function such as eval(), exec(), or subprocess execution mechanisms. This architectural design flaw enables attackers to inject arbitrary Python expressions and system commands directly into the runtime environment.\nThe attack flow proceeds as follows: First, an unauthenticated or remotely positioned threat actor identifies an exposed endpoint or interface that forwards input to the PythonREPL.run function. Second, the attacker crafts a malicious payload containing arbitrary Python code designed to perform unauthorized actions, such as importing the os or subprocess modules to execute operating system commands. Third, the attacker transmits this crafted payload via the vulnerable code argument across the network. Fourth, the Jij-MCP-Server processes the request and hands the malicious argument to the vulnerable function without validation. Finally, the Python interpreter executes the injected payload in the context of the running server process, yielding immediate remote code execution with the privileges of the application.\nThe vulnerable component is identified as the jm_check component within Jij-Inc Jij-MCP-Server version 0.1.0, specifically targeting the jij_mcp/python_repr.py file and the PythonREPL.run function. The vulnerability exhibits network exposure, allowing remote exploitation without requiring prior authentication or elevated privileges, depending on how the component exposes its interface. The post-exploitation impact includes complete confidentiality, integrity, and availability compromise of the host system, facilitating data exfiltration, malware installation, lateral movement within the network, and complete system takeover."
}