CVE-2026-44717

Critical

Published: 15/05/2026(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The MCP Calculate Server, based on the MCP protocol and SymPy library, prior to version 0.1.1, used eval() to evaluate mathematical expressions without proper input sanitization, leading to remote code execution.

Risk Assessment

Exploitation of this vulnerability could allow attackers to execute code remotely on the server, posing a significant threat to the security of the system and the organization's data.

Recommendation

It is recommended to upgrade to version 0.1.1 or later to mitigate this vulnerability.

Original NVD description (English source)

MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library. Prior to 0.1.1, the use of eval() to evaluate mathematical expressions without proper input sanitization leads to remote code execution. This vulnerability is fixed in 0.1.1.