The vulnerability results from an overly permissive Deno sandbox configuration in the Pydantic‑AI mcp‑run‑python tool. Python code executed inside the sandbox is granted unrestricted access to the localhost network interface of the host machine. This allows an attacker to issue internal HTTP requests from the tool, effectively enabling server‑side request forgery. The flaw could let an adversary probe internal services, exfiltrate data, or pivot to additional targets within the host, as the code runs with local privileges.

Pydantic‑AI mcp‑run‑python, an archived project with no maintained updates or patch releases. No specific release versions are documented, and the tool remains unchanged since its last activity.

The CVSS score of 5.8 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to run malicious Python code that the mcp‑run‑python sandbox executes; from that position the attacker can send arbitrary requests to the host’s localhost interface. Because the project is archived and unlikely to receive a fix, the risk must be mitigated through configuration changes or by discontinuing use of the tool.