FrontMCP CVE-2026-67531

The server must be running FrontMCP prior to 1.5.7 with the CodeCall plugin's codecall:execute tool enabled and reachable, and with tool schemas defined using Zod v4 (whose non-configurable, non-writable _zod own property forces the Proxy membrane to leak the raw host object). No special conditions are required against default configurations: the framework's DEFAULT_AUTH_OPTIONS is public mode, so an unconfigured server serves codecall:execute to remote unauthenticated callers, and one tools/call suffices to escape. Limiting factors: on servers explicitly configured with authentication, direct exploitation requires a valid caller, though an indirect prompt-injection payload in fetched content or upstream tool output can still trigger it without a human attacker; the codecall:execute tool must be exposed (removing/disabling CodeCall eliminates the vector), and the target tool must be within any allowedTools whitelist the script was invoked with.

The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) is internally consistent with the description: network-reachable, low complexity, no privileges or user interaction required against a default public-mode server, with high confidentiality, integrity, and availability impact from arbitrary code execution. This is a genuine top-tier priority, not a high-CVSS-but-low-real-risk case: exploitation needs a single tools/call, requires no special preconditions on default configurations, and yields full server compromise plus secret exfiltration. Note the vector marks subsequent-system impact SC/SI/SA:N even though this is technically a sandbox escape into the host process - arguably a scope-change condition - so real blast radius (host, then any downstream systems reachable with the stolen credentials) may exceed what the base metrics convey. No EPSS score or CISA KEV entry is provided, so widespread automated exploitation is not confirmed; however, the escape technique is fully documented in the GHSA advisory and reproduced in the fix commit's regression tests, materially lowering the barrier to weaponization. On authenticated deployments the PR:N assumption is weaker, but the description notes indirect prompt injection in tool output or fetched content can trigger the same path without a human attacker.

An attacker sends a single tools/call to a network-reachable FrontMCP server invoking codecall:execute with a short script that calls getTool() on any tool, reads the returned schema's _zod internal, and walks _zod.constr.constructor to obtain the host Function constructor, then runs Function('return process')() to execute arbitrary code and read environment secrets. On a default public-mode server this needs no authentication; on an authenticated server, an attacker can instead plant an indirect prompt injection in content the agent fetches or in another tool's output so the agent itself issues the malicious script. Publicly available exploit code exists - the fix commit's regression tests demonstrate the exact escape sequence.