CVE-2026-67531
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
FrontMCP prior to 1.5.7 has a vulnerability in the codecall:execute tool that allows sandbox escape and remote code execution. By exploiting Zod objects, a script can access the Function constructor and execute arbitrary code in the server process. A single tools/call is sufficient to achieve full compromise.
Risk Assessment
An attacker can execute arbitrary code on the server, gaining access to OAuth secrets, JWT keys, database credentials, and cloud metadata. In public mode (default), the vulnerability is accessible to unauthenticated attackers.
Recommendation
Update FrontMCP to version 1.5.7 or later. Configure authentication and restrict access to the server.
Other vulnerabilities in FrontMCP
See all- CVE-2026-59973High
In mcp-from-openapi (2.3.0–2.5.0) and frontmcp and @frontmcp/adapters (1.2.1–1.5.0), loadOpenAPISpec() forwards untrusted OpenAPI URLs and inputs to the tool generator without proper destination validation. The external $ref guard only checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirects, or normalizing IPv4-mapped IPv6. An authenticated user able to import an OpenAPI specification can force requests to internal services.
- CVE-2026-39885High
The mcp-from-openapi library in FrontMCP prior to version 2.3.0 does not restrict $ref dereferencing in OpenAPI specifications, enabling SSRF and local file read attacks when processing untrusted specifications.
Original NVD description (English source)
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non-configurable, non-writable own property, the ECMAScript Proxy invariants force the security membrane to hand back the raw host object, letting a script reach _zod.constr.constructor (the host Function constructor) and execute arbitrary code in the server process. A single tools/call is sufficient to escape the sandbox and achieve remote code execution as the server user, exposing everything the process holds such as OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata. Because the framework's DEFAULT_AUTH_OPTIONS is public mode, an unconfigured server serves this to unauthenticated callers, and on authenticated servers an indirect prompt injection in tool output or fetched content can trigger it without a human attackerThis issue is fixed in version 1.5.7.