TI-2026-09191 Aliases CVE-2026-10692 GHSA-647r-72hf-4vmh

johnhuang316 code-index-mcp search_code_advanced is_safe_regex_pattern redos

MEDIUM 57CWE-1333Published 2026-06-02 · Updated 2026-06-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.

Summary

A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function is_safe_regex_pattern of the component search_code_advanced. Executing a manipulation of the argument regex can lead to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.14.1 is able to address this issue. This patch is called 25bc02fac74051ddae15ce79e952f00211b1ea6b. Upgrading the affected component is recommended.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0031 24th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed code-index-mcp (johnhuang316): 2.14.1code-index-mcp (PyPI): 2.14.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
johnhuang316	code-index-mcp	2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6; 2.7; 2.8; 2.9; 2.10; 2.11; 2.12; 2.13; 2.14.0	2.14.1	Patch available	CNA
—	code-index-mcp (PyPI)	before 2.14.1	2.14.1	Patch available	GHSA-647r-72hf-4vmh

code-index-mcp Vendorjohnhuang316 Affected 2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6; 2.7; 2.8; 2.9; 2.10; 2.11; 2.12; 2.13; 2.14.0 Fixed in 2.14.1 Patch available CNA
code-index-mcp (PyPI) Vendor— Affected before 2.14.1 Fixed in 2.14.1 Patch available GHSA-647r-72hf-4vmh

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:johnhuang316:code-index-mcp::::::::	—	—	johnhuang316

cpe:2.3:a:johnhuang316:code-index-mcp:*:*:*:*:*:*:*:* Versions — — ·johnhuang316

Remediation

Fix · CNA code-index-mcp (johnhuang316) Fixed in 2.14.1
Fix · GHSA-647r-72hf-4vmh code-index-mcp (PyPI) Fixed in 2.14.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-10692
2026-10-03 Alias added: GHSA-647r-72hf-4vmh

References

Exploit 1

https://github.com/johnhuang316/code-index-mcp/issues/84

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-10692

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences