PT-2026-68355
CVE-2026-67531
·
Published
2026-08-05
·
Updated
2026-08-06
Description by
CVSS 4.0
9.3
CriticalMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
FrontMCP versions prior to 1.5.7
Description
The sandboxed
codecall:execute tool exposes live host Zod schema instances to scripts through the getTool() function. Due to Zod v4 defining zod as a non-configurable and non-writable own property, ECMAScript Proxy invariants force the security membrane to return the raw host object. This allows a script to access zod.constr.constructor (the host Function constructor) and execute arbitrary code within the server process. A single tools/call can be used to escape the sandbox and achieve remote code execution as the server user, potentially exposing sensitive data such as OAuth client secrets, JWT SECRET, session keys, database credentials, and cloud instance metadata. Since the DEFAULT AUTH OPTIONS is set to public mode, unconfigured servers are vulnerable to unauthenticated callers, while authenticated servers may be triggered via indirect prompt injection in tool output or fetched content.Recommendations
Update to version 1.5.7.
Found an issue in the description? Have something to add? Feel free to write us 👾