MCP eval() Epidemic Reaches 30+ CVEs

The MCP CVE count reached 30+, all sharing the same root cause: user-controlled input reaching exec()/eval() without sanitization. AgentAudit scanned 194 MCP packages and found 118 security findings across 68 packages — 14 rated critical or high. Anthropic's own Git MCP server had 3 CVEs enabling RCE via prompt injection (patched). Across 16 responsible disclosures to network-exposed MCP servers, response rates were low. Action: Audit every MCP server you use for eval()/exec() calls with user input. Use mcp-scan for automated detection. (DEV Community / Kai Security)