{"data":{"id":"7192ff8f-d09c-4060-9e8f-36693d865e72","title":"CVE-2026-67531: FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:ex","summary":"FrontMCP, a TypeScript framework for the Model Context Protocol (MCP, a system for AI models to interact with external tools), has a critical vulnerability in versions before 1.5.7 where a sandboxed code execution tool leaks access to the host's Function constructor, allowing attackers to run arbitrary code on the server and steal sensitive data like API keys and database credentials. The vulnerability can be exploited by unauthenticated users on unconfigured servers, or through prompt injection (tricking an AI by hiding instructions in its input) on authenticated servers.","solution":"This issue is fixed in version 1.5.7.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67531","publishedAt":"2026-08-06T00:16:53.733Z","cveId":"CVE-2026-67531","cweIds":["CWE-94"],"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["LangChain"],"affectedVendorsRaw":["FrontMCP","Model Context Protocol"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-08-06T00:16:53.733Z","capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0051"]}}