A weakness within the search_code_advanced component of the code-index-mcp project allows an attacker to supply a malicious regular expression that triggers excessive CPU consumption. This is a classic regular expression denial of service (RegexDoS) flaw, identified as CWE‑1333, and it can also lead to resource exhaustion, CWE‑400. The attack can be launched remotely by submitting the crafted pattern through the search interface, potentially rendering the service unresponsive for legitimate users.

The vulnerability affects the code-index-mcp project by johnhuang316, specifically all releases up to and including version 2.14.0. The problem resides in the is_safe_regex_pattern function of the search_code_advanced module. Any deployment of these versions without the patch is at risk.

The CVSS score of 5.3 indicates a moderate severity, and the publicly available exploit demonstrates that the flaw can be abused without authentication. Although the EPSS score is not available, the existence of an open source exploit and the ability to trigger runaway regular expression execution suggest a non‑negligible likelihood of exploitation, especially in publicly exposed deployments. The failure mode is service disruption rather than data breach, and the vulnerability is not listed in the CISA KEV catalog.