CVE-2026-67531: FrontMCP sandbox escape to remote code execution through codecall:execute tool

Summary

FrontMCP, a TypeScript framework for the Model Context Protocol, is affected by CVE-2026-67531 in versions prior to 1.5.7. The sandboxed codecall:execute tool exposes live host Zod schema instances through getTool(), and because Zod v4 defines _zod as non-configurable and non-writable, the Proxy invariants return the raw host object, letting a script reach the host Function constructor and run arbitrary code in the server process. A single tools/call is enough, and the attacker gains the server user's privileges, including OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata. Because DEFAULT_AUTH_OPTIONS defaults to public mode, unconfigured servers expose this to unauthenticated callers, and on authenticated servers an indirect prompt injection in tool output or fetched content can trigger it without a human attacker.

Mitigation

Fixed in version 1.5.7.

Topics

• Model Context Protocol
• Prompt injection and jailbreaks

Related items

• MediumFake OpenAI, SpaceX events used to steal Microsoft, Google accountsSimilar attack · BleepingComputer
• HighGHSA-64vx-6h2c-rjh7: Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCESimilar attack · GitHub Advisory Database
• MediumHacking on Autopilot: Inside ARTEX Cybercrime CampaignsSimilar attack · Check Point Research
• MediumResearchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User InteractionSimilar attack · The Hacker News
• InfoTrueFoundry & Straiker | AI Gateway Security for AgentsSimilar attack · Straiker Blog