CVE-2026-10692: Code Index MCP is vulnerable to Uncontrolled Resource Consumption
A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function issaferegexpattern of the component searchcodeadvanced. Executing a manipulation of the argument regex can lead to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
Published Jun 3, 2026 · Updated Jul 10, 2026
Affected packages
code-index-mcp
- Ecosystem
- PyPI
- Affected
- < 2.14.1
- Fixed in
- 2.14.1
- Check
pip show code-index-mcp
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function is_safe_regex_pattern of the component search_code_advanced. Executing a manipulation of the argument regex can lead to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.14.1 is able to address this issue. This patch is called 25bc02fac74051ddae15ce79e952f00211b1ea6b. Upgrading the affected component is recommended.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-10692
- https://github.com/johnhuang316/code-index-mcp/issues/84
- https://github.com/johnhuang316/code-index-mcp/commit/25bc02fac74051ddae15ce79e952f00211b1ea6b
- https://github.com/johnhuang316/code-index-mcp
- https://github.com/johnhuang316/code-index-mcp/releases/tag/v2.14.1
- https://vuldb.com/cve/CVE-2026-10692
- https://vuldb.com/submit/830786
- https://vuldb.com/vuln/367961
- https://vuldb.com/vuln/367961/cti
- https://github.com/advisories/GHSA-647r-72hf-4vmh
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Other MCP servers and tools vulnerabilities
All Other MCP servers and tools entriesCVE-2026-77361
obsidian-tc : Symlink read-ACL scope bypass via lexical path checks
medium4.7Oct 23, 2026CVE-2026-114126
Storybook dev server vulnerable to code injection from the local network
high8.7Oct 22, 2026CVE-2026-113731
djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
low3.3Oct 21, 2026CVE-2026-114125
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
critical9.4Oct 21, 2026CVE-2026-111770
MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
high7.7Oct 20, 2026GHSA-953h-535j-jg2v
agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable
medium6.8Oct 19, 2026