CVE-2026-19958

Name of the Vulnerable Software and Affected Versions iatsiuk pptr-mcp versions prior to 0.2.8

Description A flaw in the execute Tool component allows for remote code injection. The issue resides within the executeCode() function located in the src/vm-executor.ts file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the executeCode() function to minimize the risk of exploitation.