CVE-2026-44717
Critical
Description
MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library. Prior to 0.1.1, the use of eval() to evaluate mathematical expressions without proper input sanitization leads to remote code execution. This vulnerability is fixed in 0.1.1.
SeverityCritical
CVSS9.8
Exploit probability—
Product611711dark Mcp Calculate Server
PublishedMay 15, 2026
First seenMay 15, 2026
Weakness typeCWE-94Code injectionCWE-1427CWE-1427
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| 611711Dark mcp_calculate_server | < 0.1.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.