CVE-2026-19964 MEDIUM

CVE-2026-19964: Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injection

Vendor Jij-Inc

Product Jij-MCP-Server

Weakness CWE-94 · Code injection

Published August 16, 2026

Last update August 16, 2026

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was found in Jij-Inc Jij-MCP-Server 0.1.0. This affects the function PythonREPL.run of the file jij_mcp/python_repr.py of the component jm_check. The manipulation of the argument code results in code injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Key dates

02Disclosure timeline

August 16, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-19964 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html AskarLabs — CWE-94 write-up Code Injection

Related vulnerabilities

CVE-2026-19964: Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injection

01Description

02Disclosure timeline

03References

04Related CVE