Vendor
The sagemath-mcp-server package version 1.0.1 contains a vulnerability that allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.