CVE-2026-67531 FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool
FrontMCP allows sandbox escape and remote code execution via exposed Zod schemas, enabling attackers to steal secrets and execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-67531?
CVE-2026-67531 is a critical code injection vulnerability in agentfront frontmcp, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non-configurable, non-writable own property, the ECMAScript Proxy invariants force the security membrane to hand back the raw host object, letting a script reach _zod.constr.constructor (the host Function constructor) and execute arbitrary code in the server process. A single tools/call is sufficient to escape the sandbox and achieve remote code execution as the server user, exposing everything the process holds such as OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata. Because the framework's DEFAULT_AUTH_OPTIONS is public mode, an unconfigured server serves this to unauthenticated callers, and on authenticated servers an indirect prompt injection in tool output or fetched content can trigger it without a human attackerThis issue is fixed in version 1.5.7.
Weakness: CWE-94
Which versions are affected by CVE-2026-67531?
How do I fix CVE-2026-67531?
No fix has been published for CVE-2026-67531 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-67531 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67531 exists.
Sources
Also known as GHSA-mp29-fxh8-92px.