Sandbox escape to remote code execution in FrontMCP plugin-codecall (CVE-2026-67531)

The `codecall:execute` tool in `@frontmcp/plugin-codecall` exposes live host Zod schema instances to sandboxed scripts through `getTool()`. Because Zod v4 defines `_zod` as a non-configurable, non-writable own property, ECMAScript Proxy invariants force the security membrane to return the raw host object, enabling a script to reach the host `Function` constructor and execute arbitrary code in the server process. A single `tools/call` is sufficient to escape the sandbox; under the framework's default public authentication mode no credentials are required, and exploitation exposes everything the process holds including OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata. Affected versions: - <= 1.5.6 We recommend updating to: 1.5.7. CVSS 9.3 · our assessment: act_now Reference: https://github.com/agentfront/frontmcp/security/advisories/GHSA-mp29-fxh8-92px Details: https://vuln.today/cve/CVE-2026-67531