The flaw lies in the runPython and runPythonAsync functions, which execute Python code that is not isolated from the surrounding JavaScript. Because the Pyodide APIs are accessible, injected Python can alter the JavaScript environment of the MCP server. This weakness, classified as CWE‑653, could allow an attacker to hijack the MCP server, enabling malicious activities such as tool shadowing or other unauthorized control within the server process.

The vulnerability exists in the mcp‑run‑python component of JFrog's MCP server. The project is archived and no new releases are expected, but any deployment that still uses runPython or runPythonAsync remains affected.

The CVSS score is 5.8, indicating a medium severity impact. The EPSS score is below 1%, implying a very low probability of observed exploitation, and the issue is not listed in the CISA KEV catalog. The likely attack vector is an adversary able to supply arbitrary Python code to runPython or runPythonAsync; no additional prerequisites beyond code execution are mentioned, so the exploitation path is fairly straightforward if the endpoint is exposed. The combination of medium severity and low exploitation probability suggests that immediate updates are not mandatory, but the control loss warrants careful assessment.