CVE-2026-67531
- Source
- https://cve.org/CVERecord?id=CVE-2026-67531
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67531.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-67531
- Aliases
-
- GHSA-mp29-fxh8-92px
- Published
- 2026-08-05T22:54:36Z
- Modified
- 2026-09-12T03:30:25Z
- Severity
-
- 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool
- Details
-
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non-configurable, non-writable own property, the ECMAScript Proxy invariants force the security membrane to hand back the raw host object, letting a script reach _zod.constr.constructor (the host Function constructor) and execute arbitrary code in the server process. A single tools/call is sufficient to escape the sandbox and achieve remote code execution as the server user, exposing everything the process holds such as OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata. Because the framework's DEFAULT_AUTH_OPTIONS is public mode, an unconfigured server serves this to unauthenticated callers, and on authenticated servers an indirect prompt injection in tool output or fetched content can trigger it without a human attackerThis issue is fixed in version 1.5.7.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-94" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67531.json" }- References