Code Runner MCP Server contains an unauthenticated remote code execution vulnerability…

12 May 2026 critical vulnerability

Code Runner MCP Server contains an unauthenticated remote code execution vulnerability (CVE-2026-5029) when HTTP transport is enabled, allowing arbitrary code execution via exposed JSON-RPC endpoint.

CERT Polska has coordinated disclosure of CVE-2026-5029, a critical remote code execution vulnerability in Code Runner MCP Server. When the server is run with the --transport http option, it exposes an unauthenticated JSON-RPC endpoint on port 3088. An unauthenticated remote attacker can exploit this by invoking the run-code MCP tool to submit arbitrary source code, which is then executed through child_process.exec() using a specified language interpreter.

The vulnerability allows execution of arbitrary code with the privileges of the user running the server process. According to CERT Polska, this vulnerability remains unpatched and potentially affects all versions of the software. The issue was responsibly disclosed by security researcher Eryk Winiarz.

Organizations running Code Runner MCP Server with HTTP transport enabled should consider this a high-priority remediation item. Until a patch is available, operators should disable HTTP transport mode or implement network-level access controls to restrict access to port 3088.

Mentioned in this report

Vulnerabilities CVE-2026-5029

Detection guidance

Node.js MCP Server Spawning Command Interpreter (Code Runner RCE)

ATT&CK T1059

Detects a Node.js process (as used by Code Runner MCP Server) spawning a shell or scripting interpreter, consistent with exploitation of the run-code tool via child_process.exec(). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Node.js MCP Server Spawning Command Interpreter
id: 377f7d3e-d75e-50c9-b179-5c231dcb6f4d
status: experimental
description: Detects Node.js (node.exe) spawning shell or scripting interpreters,
  matching the behaviour of Code Runner MCP Server executing attacker-supplied code
  via child_process.exec() when exploited through CVE-2026-5029.
references:
- CVE-2026-5029
author: Vorant
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \node.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \python.exe
    - \perl.exe
    - \ruby.exe
    - \wscript.exe
    - \cscript.exe
  filter:
    CommandLine|contains:
    - npm
    - node_modules\.bin
    - gulp
    - webpack
  condition: selection and not filter
falsepositives:
- Legitimate Node.js build tooling or npm scripts invoking shell commands during development
  or CI/CD
- Node-based automation frameworks that legitimately spawn interpreters as part of
  normal operation
level: medium
tags:
- attack.t1059
- attack.t1190

Node.js Process Spawning Shell via child_process.exec on Linux (Code Runner RCE)

ATT&CK T1059.004

Detects a node process on Linux spawning /bin/sh or /bin/bash with -c, consistent with the Code Runner MCP Server run-code tool executing arbitrary code through child_process.exec(). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Node.js Process Spawning Shell via child_process.exec on Linux
id: dd13109a-4325-5c2d-9132-d9dc740b4177
status: experimental
description: Detects a Linux node process spawning a shell with -c, matching the behaviour
  of Code Runner MCP Server executing attacker-supplied code via child_process.exec()
  when exploited through CVE-2026-5029.
references:
- CVE-2026-5029
author: Vorant
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /node
    Image|endswith:
    - /sh
    - /bash
    - /dash
    CommandLine|contains: -c
  filter:
    ParentCommandLine|contains:
    - npm
    - yarn
    - pm2
  condition: selection and not filter
falsepositives:
- Legitimate Node.js applications or process managers that shell out to run build/deploy
  scripts
- Containerized Node services using shell wrappers for startup scripts
level: medium
tags:
- attack.t1059.004
- attack.t1190

Inbound Connection to Code Runner MCP Server HTTP Port (3088)

ATT&CK T1190

Detects inbound network connections to a Node.js process listening on TCP port 3088, the default unauthenticated JSON-RPC endpoint exposed by Code Runner MCP Server in --transport http mode. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Inbound Connection to Code Runner MCP Server HTTP Port
id: e8bc9493-23ba-5231-97b2-7bbf6799b658
status: experimental
description: Detects network connections established to TCP port 3088 on a host running
  a node.exe/node process, matching the exposed unauthenticated JSON-RPC endpoint
  of Code Runner MCP Server vulnerable to CVE-2026-5029 when run with --transport
  http.
references:
- CVE-2026-5029
author: Vorant
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 3088
    Image|endswith: \node.exe
    Initiated: 'false'
  condition: selection
falsepositives:
- Internal monitoring or health-check systems legitimately polling the MCP server
  on port 3088
- Load balancers or reverse proxies configured to forward traffic to the Code Runner
  service
level: low
tags:
- attack.t1190

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-5029

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free