Vulnerability · Published Aug 16, 2026 · Assigned by VulDB

CVE-2026-19964Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injection

Medium 5.5

In plain English

A medium-severity code injection in Jij-MCP-Server from Jij-Inc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.3%top 77.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Jij-Inc Jij-MCP-Server 0.1.0. This affects the function PythonREPL.run of the file jij_mcp/python_repr.py of the component jm_check. The manipulation of the argument code results in code injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
Jij-Inc	Jij-MCP-Server	0.1.0

Weakness: CWE-94, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-391141 | Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injection vdb-entry, technical-description
VDB-391141 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-19964 | CVE Analysis and Report third-party-advisory
Submit #872906 | Jij-Inc Jij-MCP-Server Latest remote code execute third-party-advisory
http://github.com/Jij-Inc/Jij-MCP-Server/issues/4 exploit, issue-tracking