HTTP Mode Turns Code Runner Into Remote Code Surface
The broken assumption is that Code Runner MCP Server is a local helper. When it is started with --transport http, it exposes an unauthenticated JSON-RPC endpoint that lets a remote caller run arbitrary code as the server user. That turns a convenience interface into a process-level backdoor for anything that account can reach.
CERT Polska says CVE-2026-5029 affects Code Runner MCP Server on port 3088 at /mcp, and the issue is still unfixed. The flaw can be triggered by invoking the run-code tool with attacker-supplied source code, and CERT says it may affect all versions.
The blast radius is the permissions, files, and secrets of the account running the service. Any deployment exposed beyond localhost is in scope until the project ships a fix.