CVE-2026-7149 - dexhunter kaggle-mcp server.py prepare_kaggle_dataset path traversal

Back Back to CVE browser

MEDIUM

dexhunter kaggle-mcp server.py prepare_kaggle_dataset path traversal

Published Apr 27, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.59%

Description

A vulnerability has been found in dexhunter kaggle-mcp up to 406127ffcb2b91b8c10e20e6c2ca787fbc1dc92d. This vulnerability affects the function prepare_kaggle_dataset of the file src/kaggle_mcp/server.py. The manipulation of the argument competition_id leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

Vendor Dexhunter Product Kaggle-Mcp Default
n/a
- Version
  
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Dexhunter

Kaggle-Mcp

n/a

Version	Status	Constraints
	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (8)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25911
Advisory
https://github.com/advisories/GHSA-q882-jc55-6343
Advisory
https://github.com/dexhunter/kaggle-mcp
product
https://github.com/dexhunter/kaggle-mcp/issues/1
exploitissue-tracking
https://nvd.nist.gov/vuln/detail/CVE-2026-7149
https://vuldb.com/submit/802052
third-party-advisory
https://vuldb.com/vuln/359748
vdb-entrytechnical-description
https://vuldb.com/vuln/359748/cti
signaturepermissions-required

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25911		Advisory
https://github.com/advisories/GHSA-q882-jc55-6343		Advisory
https://github.com/dexhunter/kaggle-mcp		product
https://github.com/dexhunter/kaggle-mcp/issues/1		exploitissue-tracking
https://nvd.nist.gov/vuln/detail/CVE-2026-7149
https://vuldb.com/submit/802052		third-party-advisory
https://vuldb.com/vuln/359748		vdb-entrytechnical-description
https://vuldb.com/vuln/359748/cti		signaturepermissions-required