CVE-2026-19958

Received Received - Intake

Code Injection in pptr-mcp

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: VulDB

Description

A security flaw has been discovered in iatsiuk pptr-mcp up to 0.2.7. The impacted element is the function executeCode of the file src/vm-executor.ts of the component execute Tool. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-16

Last Modified

2026-08-16

Generated

2026-08-17

AI Q&A

2026-08-17

EPSS Evaluated

N/A

NVD

CVE-2026-19958

EUVD

EUVD-2026-59996

Affected Vendors & Products

Vendor	Product	Version / Range
iatsiuk	pptr-mcp	to 0.2.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a code injection flaw in the iatsiuk pptr-mcp software up to version 0.2.7. It exists in the executeCode function of the src/vm-executor.ts file within the executeTool component. An attacker can remotely exploit this to inject malicious code.

Impact Analysis

If you use the affected software, an attacker could execute arbitrary code on your system remotely. This may lead to unauthorized access, data theft, or system compromise depending on the attacker's goals.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties.

Mitigation Strategies

Immediately update iatsiuk pptr-mcp to the latest version beyond 0.2.7. If no update is available, consider disabling the executeCode function in src/vm-executor.ts or isolating the component from untrusted input. Monitor for unusual network activity or unauthorized code execution.

Hi! I’m here to help you understand CVE-2026-19958. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70