{"id":"CVE-2026-67531","summary":"FrontMCP: CodeCall sandbox escape -\u003e host RCE via live Zod schema exposure by getTool","details":"FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non-configurable, non-writable own property, the ECMAScript Proxy invariants force the security membrane to hand back the raw host object, letting a script reach _zod.constr.constructor (the host Function constructor) and execute arbitrary code in the server process. A single tools/call is sufficient to escape the sandbox and achieve remote code execution as the server user, exposing everything the process holds such as OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata. Because the framework's DEFAULT_AUTH_OPTIONS is public mode, an unconfigured server serves this to unauthenticated callers, and on authenticated servers an indirect prompt injection in tool output or fetched content can trigger it without a human attackerThis issue is fixed in version 1.5.7.","aliases":["GHSA-mp29-fxh8-92px"],"modified":"2026-08-08T03:30:46.636108311Z","published":"2026-08-05T22:54:36.219Z","database_specific":{"cwe_ids":["CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67531.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67531.json"},{"type":"ADVISORY","url":"https://github.com/agentfront/frontmcp/security/advisories/GHSA-mp29-fxh8-92px"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67531"},{"type":"FIX","url":"https://github.com/agentfront/frontmcp/commit/209cddd19a8d4db0777f725b527818da7df6f67f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/agentfront/frontmcp","events":[{"introduced":"0"},{"fixed":"209cddd19a8d4db0777f725b527818da7df6f67f"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.5.7"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.5.6","v1.5.5","v1.5.4","v1.5.3","v1.5.2","v1.5.1","v1.5.0","v1.5.0-rc.1","v0.8.1","v0.8.0","v0.7.2","v0.7.1","v0.6.3","v0.6.2","v0.6.1","v0.6.0","v0.5.1","v0.5.0","v0.4.0","v0.3.1","v0.3.0","v0.2.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67531.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}