CVE-2026-57860 Details
Description
ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and args values (for example, command: bash with args: ['-c', 'touch /tmp/pwned']). When a user runs the forge CLI inside a cloned untrusted repository, the specified commands are spawned with the invoking user's privileges, resulting in arbitrary code execution. This provides a reliable initial-access and persistence primitive against developers who evaluate untrusted repositories with ForgeCode.
A vulnerability in ForgeCode, an AI pair-programming CLI, allows for arbitrary code execution. This issue arises because the application automatically loads and executes MCP servers defined in a repository's .mcp.json file upon startup, without user confirmation. If a malicious repository is cloned, the .mcp.json file can be crafted to include commands that, when executed, could perform harmful actions, such as creating a reverse shell or writing files to the system. This vulnerability exploits the trust developers place in the tool when evaluating untrusted repositories.
Users can update to ForgeCode version 2.11.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tailcallhq/forgecode/issues/3022 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/tailcallhq/forgecode | [email protected] | ProductSource CodeVendor |
| https://github.com/tailcallhq/forgecode/commit/68ca3a3a26c73c38a700453d3d021b5bbdc15dbd | [email protected] | Source CodeVendor |
| https://github.com/tailcallhq/forgecode/issues/3022 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/tailcallhq/forgecode/issues/3252 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/forgecode-arbitrary-code-execution-via-unvetted-mcp-json-in-untrusted-repository | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tailcallhq/forgecode | <= 2.11.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 17, 2026 | New CVE Received | [email protected] |
| Jul 17, 2026 | CVE Modified | CISA-ADP |