CVE-2026-1977

Name of the Vulnerable Software and Affected Versions isaacwasserman mcp-vegalite-server versions prior to 16aefed598b8cd897b78e99b907f6e2984572c61

Description A security issue exists in the eval function of the visualize data component. Manipulation of the vegalite specification argument can lead to code injection. This attack can be initiated remotely. The exploit for this issue has been publicly disclosed.

Recommendations Versions prior to 16aefed598b8cd897b78e99b907f6e2984572c61 should be updated. As a temporary workaround, consider restricting or disabling the use of the visualize data component until a suitable update is available. Avoid using the vegalite specification parameter in the affected function eval() until the issue is resolved.