CVE-2026-67531

Name of the Vulnerable Software and Affected Versions FrontMCP versions prior to 1.5.7

Description The sandboxed codecall:execute tool exposes live host Zod schema instances to scripts through the getTool() function. Due to Zod v4 defining zod as a non-configurable and non-writable own property, ECMAScript Proxy invariants force the security membrane to return the raw host object. This allows a script to access zod.constr.constructor (the host Function constructor) and execute arbitrary code within the server process. A single tools/call can be used to escape the sandbox and achieve remote code execution as the server user, potentially exposing sensitive data such as OAuth client secrets, JWT SECRET, session keys, database credentials, and cloud instance metadata. Since the DEFAULT AUTH OPTIONS is set to public mode, unconfigured servers are vulnerable to unauthenticated callers, while authenticated servers may be triggered via indirect prompt injection in tool output or fetched content.

Recommendations Update to version 1.5.7.