Which versions of FrontMCP are affected by CVE-2026-67531?

FrontMCP, an agent framework, contains a critical remote code execution vulnerability (CVSS 9.3) that allows unauthenticated attackers to escape the sandbox and execute arbitrary code on affected…

How to fix or mitigate CVE-2026-67531?

Within 24 hours, audit all FrontMCP deployments to identify versions prior to 1.5.7 and assess network exposure; immediately implement network segmentation to restrict public access and disable unauthenticated exposure. Within 7 days, reconfigure all instances to disable DEFAULT_AUTH_OPTIONS and require explicit authentication, then conduct a security audit of potentially exposed credentials (OAuth secrets, JWT_SECRET, database credentials, cloud metadata) and initiate rotation of any compromised keys. Within 30 days, monitor the FrontMCP GitHub repository and vendor security advisories for release of a patched version and deploy immediately upon availability; if FrontMCP cannot be isolated from untrusted networks during this period, consider evaluating alternative agent frameworks.

FrontMCP CVE-2026-67531

Q: What is the CVSS score of CVE-2026-67531?

CVE-2026-67531 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

CRITICAL

Code Injection (CWE-94)

2026-08-05 GitHub_M

RCE Code Injection Frontmcp Agentfront

9.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Default public mode makes it network-reachable and unauthenticated (AV:N/PR:N), a single scriptable call is low-complexity (AC:L/UI:N), and host RCE yields full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 05, 2026 - 23:51 vuln.today

Analysis Generated

Aug 05, 2026 - 23:51 vuln.today

CVE Published

Aug 05, 2026 - 22:54 cve.org

CRITICAL 9.3

DescriptionCVE.org

FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non-configurable, non-writable own property, the ECMAScript Proxy invariants force the security membrane to hand back the raw host object, letting a script reach _zod.constr.constructor (the host Function constructor) and execute arbitrary code in the server process. A single tools/call is sufficient to escape the sandbox and achieve remote code execution as the server user, exposing everything the process holds such as OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata. Because the framework's DEFAULT_AUTH_OPTIONS is public mode, an unconfigured server serves this to unauthenticated callers, and on authenticated servers an indirect prompt injection in tool output or fetched content can trigger it without a human attackerThis issue is fixed in version 1.5.7.

AnalysisAI

Sandbox escape leading to remote code execution in FrontMCP (agentfront/frontmcp) before 1.5.7 lets a single tools/call to the codecall:execute tool break out of the script sandbox and run arbitrary code as the server user. The security membrane hands back live host Zod v4 schema instances via getTool(), giving script authors a path to the host Function constructor and full process control, exposing OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud metadata. Because the framework ships DEFAULT_AUTH_OPTIONS in public mode, unconfigured servers expose this to unauthenticated callers, and publicly available exploit code exists in the form of the fix commit's regression tests demonstrating the exact escape technique.

Technical ContextAI

FrontMCP is a TypeScript-first framework implementing the Model Context Protocol (MCP), the emerging standard by which LLM agents call server-side tools. Its CodeCall plugin runs agent-authored scripts inside a sandbox guarded by an ECMAScript Proxy 'membrane' that is supposed to return only inert copies of host objects. The root cause maps to CWE-94 (Improper Control of Generation of Code / code injection): the getTool() helper returns tool metadata whose schemas are backed by live Zod v4 validator instances. Zod v4 defines its internal _zod field as a non-configurable, non-writable own property, and the ECMAScript Proxy invariants require that a non-configurable, non-writable property report the exact underlying value - so the membrane is forced to hand back the raw host object rather than a proxy or copy. From that raw object a script traverses _zod.constr.constructor to reach the host Function constructor and evaluate strings like Function('return process')(), gaining full Node.js host capabilities. The fix (1.5.7) returns tool schemas as plain, inert JSON Schema documents that carry no schema-instance internals or methods. Affected CPE: cpe:2.3:a:agentfront:frontmcp.

RemediationAI

Vendor-released patch: 1.5.7 - upgrade FrontMCP to 1.5.7 or later, which returns tool schemas from getTool() as inert plain JSON Schema documents (null when no schema is declared) so no live host Zod instance is reachable; this is the primary and complete fix. Until you can upgrade, do not run unconfigured servers in default public mode: enable authentication so the codecall:execute path is not exposed to unauthenticated callers, and treat that as reducing-not eliminating-risk, since indirect prompt injection in tool output or fetched content can still reach the sandbox on authenticated servers. As additional compensating controls, disable or remove the CodeCall plugin / codecall:execute tool entirely if scripting is not required (trade-off: loses all script-execution functionality), restrict tool exposure via the allowedTools whitelist so scripts cannot describe sensitive host tools, and sanitize or distrust externally fetched content and upstream tool output that feeds into scripts to blunt prompt-injection triggers. Rotate any secrets the process holds (OAuth client secrets, JWT_SECRET, session keys, database credentials) if you cannot rule out prior exploitation. References: GHSA-mp29-fxh8-92px (https://github.com/agentfront/frontmcp/security/advisories/GHSA-mp29-fxh8-92px) and commit 209cddd19a8d4db0777f725b527818da7df6f67f.