Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-67531— FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool

CVSS 9.3 · Critical EPSS 0.43% · P36

Affected Version Matrix 1

VendorProductVersion RangeStatus
agentfrontfrontmcp< 1.5.7affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-67531

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool
Source: CVE Program / CVE List V5
Vulnerability Description
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non-configurable, non-writable own property, the ECMAScript Proxy invariants force the security membrane to hand back the raw host object, letting a script reach _zod.constr.constructor (the host Function constructor) and execute arbitrary code in the server process. A single tools/call is sufficient to escape the sandbox and achieve remote code execution as the server user, exposing everything the process holds such as OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata. Because the framework's DEFAULT_AUTH_OPTIONS is public mode, an unconfigured server serves this to unauthenticated callers, and on authenticated servers an indirect prompt injection in tool output or fetched content can trigger it without a human attackerThis issue is fixed in version 1.5.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
AgentFront FrontMCP 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
AgentFront FrontMCP是AgentFront组织开源的一个基于TypeScript的MCP服务器开发框架。 AgentFront FrontMCP 1.5.7之前版本存在代码注入漏洞，该漏洞源于沙箱化codecall:execute工具暴露了宿主Zod模式实例，导致脚本可访问_zod.constr.constructor并执行任意代码，可能导致远程代码执行及敏感信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
agentfrontfrontmcp < 1.5.7 -

II. Public POCs for CVE-2026-67531

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium
Qwen3.6-35B-A3B · 8006 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-67531

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-67531 (1)

IV. Related Vulnerabilities

Same product: frontmcp
Same vendor: agentfront
Same weakness: CWE-94

V. Comments for CVE-2026-67531

No comments yet

Leave a comment