Saad Elharaj

ForgeCode, an AI pair-programming CLI, automatically loads and executes Model Context Protocol (MCP) servers defined in a repository's `.mcp.json` file upon startup without requiring user confirmation. A malicious repository can contain a crafted `.mcp.json` file where the `mcpServers` entries specify arbitrary `command` and `args` values. When the CLI is executed within a cloned untrusted repository, these commands are spawned with the privileges of the invoking user, leading to arbitrary code execution. This issue serves as a mechanism for initial access and persistence against developers evaluating untrusted repositories.

An out-of-bounds read occurs when processing a crafted .blend file containing a malicious signed short `member index` value within the SDNA block. The `member index` field is used as an array index for the `sdna->members[]` array in the `sdna expand names()` function without proper bounds validation. This allows values outside the allocated range to create an invalid pointer that is passed to `strlen()`, leading to a SIGSEGV crash or the disclosure of adjacent heap memory.

A use-after-free issue exists in the `gdbr threads list()` function. This occurs when a valid qfThreadInfo response is followed by a malformed qsThreadInfo response, allowing remote attackers to trigger memory corruption via GDB remote debugging. This can lead to a denial of service or potential code execution by manipulating thread list processing.

A use-after-free issue exists in the `gdbr pids list()` function within the GDB client core. Remote attackers can cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses. The issue is triggered when `qsThreadInfo` fails after `qfThreadInfo` has successfully allocated `RDebugPid` structures, leading to double-free memory corruption during the error path cleanup process.