{"id":"CVE-2026-67531","title":"FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP)","summary":"FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a n…","severity":"none","cwe":["CWE-94"],"published":"2026-08-06","updated":"2026-09-10","sourceUpdated":"2026-09-10T20:37:00.427","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67531","references":[{"url":"https://github.com/agentfront/frontmcp/commit/209cddd19a8d4db0777f725b527818da7df6f67f","label":"security-advisories@github.com"},{"url":"https://github.com/agentfront/frontmcp/security/advisories/GHSA-mp29-fxh8-92px","label":"security-advisories@github.com"},{"url":"https://github.com/agentfront/frontmcp/security/advisories/GHSA-mp29-fxh8-92px","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00735,"epssPercentile":0.52404,"ingestedAt":"2026-09-10T21:05:53.593Z","slug":"CVE-2026-67531","body":"## Overview\n\nFrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non-configurable, non-writable own property, the ECMAScript Proxy invariants force the security membrane to hand back the raw host object, letting a script reach _zod.constr.constructor (the host Function constructor) and execute arbitrary code in the server process. A single tools/call is sufficient to escape the sandbox and achieve remote code execution as the server user, exposing everything the process holds such as OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata. Because the framework's DEFAULT_AUTH_OPTIONS is public mode, an unconfigured server serves this to unauthenticated callers, and on authenticated servers an indirect prompt injection in tool output or fetched content can trigger it without a human attackerThis issue is fixed in version 1.5.7.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}