CVE-2026-19958

The CVSS 6.3 score assigned to this code injection vulnerability in pptr-mcp fundamentally misrepresents its risk profile — not because the math is wrong, but because the scoring model lacks vocabulary for libraries whose core function is inherently dangerous. pptr-mcp connects Puppeteer to the Model Context Protocol, a library designed to let AI systems execute code in developer environments. The vulnerability exists in vm-executor.ts, where the sandbox intended to isolate executed code is being bypassed. But framing this as a sandbox escape misses the architectural point: pptr-mcp was never designed as a security boundary. Its entire purpose is executing code on behalf of AI agents — entities that process untrusted input from users. The 'trusted caller' assumption has now been violated at scale, and the CVSS model has no way to weight that failure. The AI agent integration is the mass-market exploitation pathway that's invisible to severity scoring. An attacker doesn't need network access to the developer's machine — they need only get a malicious prompt past any AI coding assistant using pptr-mcp as a backend. This dramatically lowers the attacker cost compared to traditional remote code execution. The historical pattern is damning: Node's vm module was identified as inadequate for sandboxing as far back as CVE-2017-5949. vm2 was created to address those gaps, then bypassed repeatedly (CVE-2021-21315 and others). pptr-mcp appears built on the same footing — this is the third iteration of the same architectural mistake, wrapped in AI-copacetic branding. The deeper lesson ('stop assuming your caller is trusted') keeps being forgotten as each generation encounters it fresh. The unresponsive maintainer compounds the problem structurally: abandoned libraries with public exploits become entropy conditions where forgotten-but-active code thrives. Automated scanners using CVSS-driven prioritization will deprioritize this finding, burying it in reports nobody reads — exactly the environment where transitive dependencies continue propagating the vulnerable package into new CI pipelines and developer machines every day. Defenders should treat this as a supply chain compromise vector: audit your dependency trees for pptr-mcp or any vm-module-based executors invoked by AI tooling, treat AI agent outputs as untrusted input to any downstream code execution, and recognize that the absence of a patch means the attack surface is growing daily as the ecosystem continues embedding this package into new systems.

Reviewed through automated stages and approved by a human before publication.