Code Runner MCP Server Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Code Runner MCP Server. This issue arises when the server is run with the '--transport http' option, which exposes the '/mcp' JSON-RPC endpoint on port 3088 without authentication. An unauthenticated remote attacker can use the 'run-code' MCP tool to send arbitrary source code, which is then executed via 'child_process.exec()' using the specified language interpreter. This vulnerability allows execution of arbitrary code with the same privileges as the user running the server. It is present in all versions of Code Runner MCP Server and has not been fixed.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server, with the executed code running under the user's privileges.