Description
A security flaw has been discovered in iatsiuk pptr-mcp up to 0.2.7. The impacted element is the function executeCode of the file src/vm-executor.ts of the component execute Tool. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-08-16
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A bug in the executeCode function of the execute Tool within the pptr-mcp project allows an attacker to inject arbitrary code, potentially leading to remote code execution. The vulnerability is present in all releases up to version 0.2.7 and is exploitable when an attacker can trigger the executeCode path with crafted input. The impact compromises confidentiality, integrity, and availability if exploited, as it allows execution of unintended commands or code on the target system.

Affected Systems

The affected component is iatsiuk’s pptr-mcp library, versions up to and including 0.2.7. Any installation of this library that still uses the execute Tool and its executeCode function without backported fixes is vulnerable.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.3, indicating a medium severity. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog. The description explicitly states the attack can be launched remotely and that a public exploit exists, implying that an attacker can trigger the vulnerability from an external network. The flaw arises from command and code injection weaknesses (CWE‑74 and CWE‑94), which can allow arbitrary code execution when the executeCode pathway processes untrusted input.

Generated by OpenCVE AI on August 16, 2026 at 23:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade pptr-mcp to a version newer than 0.2.7 once the maintainer releases a fix.
  • Discontinue using the executeTool or its executeCode function if it is not essential to your workflow.
  • Implement input validation or sanitization around parameters passed to executeCode to mitigate injection risks.

Generated by OpenCVE AI on August 16, 2026 at 23:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 16 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in iatsiuk pptr-mcp up to 0.2.7. The impacted element is the function executeCode of the file src/vm-executor.ts of the component execute Tool. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injection
First Time appeared Iatsiuk
Iatsiuk pptr-mcp
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:iatsiuk:pptr-mcp:*:*:*:*:*:*:*:*
Vendors & Products Iatsiuk
Iatsiuk pptr-mcp
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Iatsiuk Pptr-mcp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-16T22:15:12.817Z

Reserved: 2026-08-16T07:01:39.504Z

Link: CVE-2026-19958

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-16T23:16:24.530

Modified: 2026-08-16T23:16:24.530

Link: CVE-2026-19958

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-16T23:30:12Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')