@justice8096/sagemath-mcp-server

1 published security advisory credited to Still OS Digital Holdings LLC via MITRE.

CVE-2026-106763 ASSIGNED Command Injection (CWE-78) — Remote Code Execution

@justice8096/sagemath-mcp-server@1.0.1

A remote attacker can execute arbitrary code by supplying a crafted MCP tool-call argument that reaches a local shell invocation.

Maintain or operate @justice8096/sagemath-mcp-server? If a fix is shipped, the record is disputed, or you want the full coordinated-disclosure writeup, reach us: here. "Listed" means an independent finding was reported through MITRE and made public — not an accusation of intent. Still OS Digital Holdings LLC · security@stillosdigitalholdings.com.