CVE-2026-67531
Received Received - Intake

Remote Code Execution in FrontMCP via Zod Sandbox Escape

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non-configurable, non-writable own property, the ECMAScript Proxy invariants force the security membrane to hand back the raw host object, letting a script reach _zod.constr.constructor (the host Function constructor) and execute arbitrary code in the server process. A single tools/call is sufficient to escape the sandbox and achieve remote code execution as the server user, exposing everything the process holds such as OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata. Because the framework's DEFAULT_AUTH_OPTIONS is public mode, an unconfigured server serves this to unauthenticated callers, and on authenticated servers an indirect prompt injection in tool output or fetched content can trigger it without a human attackerThis issue is fixed in version 1.5.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-67531

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frontmcp frontmcp 1.5.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FrontMCP is a TypeScript framework for the Model Context Protocol. A flaw in versions before 1.5.7 allows sandbox escape and remote code execution. The codecall:execute tool exposes live Zod schema instances to scripts via getTool(). These schemas contain a non-configurable property _zod that forces the sandbox to return the raw host object. Attackers can then access the host's Function constructor through _zod.constr.constructor to execute arbitrary code on the server.

Detection Guidance

Check if your FrontMCP server is running a vulnerable version (1.5.6 or earlier) by inspecting the package version in your project or logs. Look for unauthorized codecall:execute tool usage in server logs or network traffic. Use commands like 'npm list @frontmcp/plugin-codecall' to verify installed versions.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on the server running FrontMCP. It can expose sensitive data like OAuth secrets, database credentials, and cloud metadata. The attack requires only a single codecall:execute call and works without authentication in default public mode. It impacts confidentiality, integrity, and availability of the system.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security. It exposes sensitive data which could lead to breaches of GDPR (personal data exposure) and HIPAA (protected health information exposure). The remote code execution risk also violates security best practices required by these regulations.

Mitigation Strategies

Upgrade to FrontMCP version 1.5.7 or later immediately. Replace live Zod schema instances with inert JSON schemas by using getInputJsonSchema() and getOutputJsonSchema() instead of getTool(). Ensure authentication is enabled if using public mode, as unauthenticated servers are vulnerable by default.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67531. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart