Agentfront
Monthly
Sandbox escape leading to remote code execution in FrontMCP (agentfront/frontmcp) before 1.5.7 lets a single tools/call to the codecall:execute tool break out of the script sandbox and run arbitrary code as the server user. The security membrane hands back live host Zod v4 schema instances via getTool(), giving script authors a path to the host Function constructor and full process control, exposing OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud metadata. Because the framework ships DEFAULT_AUTH_OPTIONS in public mode, unconfigured servers expose this to unauthenticated callers, and publicly available exploit code exists in the form of the fix commit's regression tests demonstrating the exact escape technique.
Sandbox escape in Enclave JavaScript sandbox before 2.11.1. Enclave is designed for safe AI agent code execution — the escape allows agents to execute arbitrary code outside the sandbox. CVSS 10.0, PoC and patch available.
Enclave versions up to 2.10.1 is affected by loop with unreachable exit condition (infinite loop) (CVSS 8.8).
enclave-vm JavaScript sandbox (before 2.7.0) has a critical sandbox escape. When a tool invocation fails, a host-side Error object is exposed to sandboxed code, which can use its prototype chain to access the host Node.js runtime. Maximum CVSS 10.0 with scope change. PoC available, patch available.
SSRF denylist bypass in the npm package mcp-from-openapi (2.2.0 through 2.8.0) lets an attacker who controls the OpenAPI spec URL passed to fromURL - or a redirect target it follows - reach hosts the operator listed in refResolution.blockedHosts simply by appending a trailing root dot (http://internal.corp./), because DNS resolves the dotted FQDN to the same host while the library compares raw URL.hostname strings. The same release range separately forwarded caller-supplied Authorization and Cookie headers to cross-origin redirect targets, handing bearer tokens to an open redirect on the spec host. Impact is limited to fetching operator-blocked content (low confidentiality, no integrity or availability effect), exploitation depends on non-default reliance on blockedHosts as the host guard, no CISA KEV listing exists, and the upstream advisory documents proof-of-concept reproductions; 2.9.0 normalizes hostnames on both sides of the comparison and drops caller headers once a redirect leaves the spec origin.
Credential exposure in the npm package mcp-from-openapi (versions 2.5.0 up to but not including 2.9.0) lets a malicious or compromised spec host harvest the caller's Authorization, Cookie and Proxy-Authorization headers, because the library's manual redirect loop in safeFetch() re-sends those headers unchanged to every hop - including hops that leave the spec URL's origin, which native fetch would strip. An attacker who controls the host serving the OpenAPI document, or who can exploit an open redirect on that host, receives the bearer token or cookie that the caller supplied to fromURL(); impact is confidentiality-only and bounded to the single credential handed over (higher only when that token is high-privilege), and no leak occurs when no credential headers are passed or when followRedirects is disabled. The same advisory bundles a lower-severity blockedHosts denylist bypass (a trailing root dot, e.g. http://internal.corp./, fails the exact-string comparison), relevant only to deployments that rely on blockedHosts with allowInternalIPs enabled. A vendor fix is available in 2.9.0; no public exploit code was identified at time of analysis, though the upstream advisory documents reproduction steps, and the vendor rates the issue CVSS 4.0 6.3 while our independent assessment scores it CVSS 3.1 5.9-class AV:N/AC:H with low confidentiality impact only.
Sandbox escape leading to remote code execution in FrontMCP (agentfront/frontmcp) before 1.5.7 lets a single tools/call to the codecall:execute tool break out of the script sandbox and run arbitrary code as the server user. The security membrane hands back live host Zod v4 schema instances via getTool(), giving script authors a path to the host Function constructor and full process control, exposing OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud metadata. Because the framework ships DEFAULT_AUTH_OPTIONS in public mode, unconfigured servers expose this to unauthenticated callers, and publicly available exploit code exists in the form of the fix commit's regression tests demonstrating the exact escape technique.
Sandbox escape in Enclave JavaScript sandbox before 2.11.1. Enclave is designed for safe AI agent code execution — the escape allows agents to execute arbitrary code outside the sandbox. CVSS 10.0, PoC and patch available.
Enclave versions up to 2.10.1 is affected by loop with unreachable exit condition (infinite loop) (CVSS 8.8).
enclave-vm JavaScript sandbox (before 2.7.0) has a critical sandbox escape. When a tool invocation fails, a host-side Error object is exposed to sandboxed code, which can use its prototype chain to access the host Node.js runtime. Maximum CVSS 10.0 with scope change. PoC available, patch available.
SSRF denylist bypass in the npm package mcp-from-openapi (2.2.0 through 2.8.0) lets an attacker who controls the OpenAPI spec URL passed to fromURL - or a redirect target it follows - reach hosts the operator listed in refResolution.blockedHosts simply by appending a trailing root dot (http://internal.corp./), because DNS resolves the dotted FQDN to the same host while the library compares raw URL.hostname strings. The same release range separately forwarded caller-supplied Authorization and Cookie headers to cross-origin redirect targets, handing bearer tokens to an open redirect on the spec host. Impact is limited to fetching operator-blocked content (low confidentiality, no integrity or availability effect), exploitation depends on non-default reliance on blockedHosts as the host guard, no CISA KEV listing exists, and the upstream advisory documents proof-of-concept reproductions; 2.9.0 normalizes hostnames on both sides of the comparison and drops caller headers once a redirect leaves the spec origin.
Credential exposure in the npm package mcp-from-openapi (versions 2.5.0 up to but not including 2.9.0) lets a malicious or compromised spec host harvest the caller's Authorization, Cookie and Proxy-Authorization headers, because the library's manual redirect loop in safeFetch() re-sends those headers unchanged to every hop - including hops that leave the spec URL's origin, which native fetch would strip. An attacker who controls the host serving the OpenAPI document, or who can exploit an open redirect on that host, receives the bearer token or cookie that the caller supplied to fromURL(); impact is confidentiality-only and bounded to the single credential handed over (higher only when that token is high-privilege), and no leak occurs when no credential headers are passed or when followRedirects is disabled. The same advisory bundles a lower-severity blockedHosts denylist bypass (a trailing root dot, e.g. http://internal.corp./, fails the exact-string comparison), relevant only to deployments that rely on blockedHosts with allowInternalIPs enabled. A vendor fix is available in 2.9.0; no public exploit code was identified at time of analysis, though the upstream advisory documents reproduction steps, and the vendor rates the issue CVSS 4.0 6.3 while our independent assessment scores it CVSS 3.1 5.9-class AV:N/AC:H with low confidentiality impact only.