CVE-2026-67531 Details
Description
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non-configurable, non-writable own property, the ECMAScript Proxy invariants force the security membrane to hand back the raw host object, letting a script reach _zod.constr.constructor (the host Function constructor) and execute arbitrary code in the server process. A single tools/call is sufficient to escape the sandbox and achieve remote code execution as the server user, exposing everything the process holds such as OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata. Because the framework's DEFAULT_AUTH_OPTIONS is public mode, an unconfigured server serves this to unauthenticated callers, and on authenticated servers an indirect prompt injection in tool output or fetched content can trigger it without a human attackerThis issue is fixed in version 1.5.7.
A vulnerability in the CodeCall plugin of the FrontMCP framework allows for remote code execution on the server. This issue arises because the `codecall:execute` tool exposes live Zod schema instances to the executed script. Zod v4 schemas include a non-configurable, non-writable property that, when accessed, reveals the Zod constructor. This can be exploited to obtain the host Function constructor, which executes arbitrary code in the server process. The vulnerability affects versions of the plugin through 1.5.6 and is exacerbated by the framework's default public authentication mode, allowing unauthenticated access to the vulnerable functionality.
The vulnerability is fixed in version 1.5.7 of the @frontmcp/plugin-codecall package.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 6, 2026CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/agentfront/frontmcp/security/advisories/GHSA-mp29-fxh8-92px | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/agentfront/frontmcp/commit/209cddd19a8d4db0777f725b527818da7df6f67f | [email protected] | Source CodeVendor |
| https://github.com/agentfront/frontmcp/security/advisories/GHSA-mp29-fxh8-92px | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Agentfront FrontMCP | <= 1.5.6 (semver) |
CPE
Remediation
| |
| FrontMCP | <= 1.5.6 (semver) |
CPE
Remediation
| |
| FrontMCP CLI | All versions |
CPE
Remediation
| |
| FrontMCP SDK | All versions |
CPE
Remediation
| |
| FrontMCP Utils | All versions |
CPE
Remediation
| |
| FrontMCP Package | All versions |
CPE
Remediation
| |
| FrontMCP Plugin CodeCall | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |