CVE-2026-19964

Name of the Vulnerable Software and Affected Versions Jij-Inc Jij-MCP-Server version 0.1.0

Description Code injection is possible via remote attack in the jm check component. The issue exists within the PythonREPL.run() function located in the jij mcp/python repr.py file, where manipulation of the code argument allows for the execution of arbitrary code.

Recommendations As a temporary workaround, restrict access to the PythonREPL.run() function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.