Agentfront FrontMCP up to 1.5.6 Codecall Execute getTool sandbox

Summaryinfo

A vulnerability described as very critical has been identified in Agentfront FrontMCP up to 1.5.6. Affected is the function getTool of the component Codecall Execute. Executing a manipulation can lead to sandbox. This vulnerability is registered as CVE-2026-67531. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Agentfront FrontMCP up to 1.5.6. It has been declared as very critical. This vulnerability affects the function getTool of the component Codecall Execute. The manipulation with an unknown input leads to a sandbox vulnerability. The CWE definition for the vulnerability is CWE-265. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non-configurable, non-writable own property, the ECMAScript Proxy invariants force the security membrane to hand back the raw host object, letting a script reach _zod.constr.constructor (the host Function constructor) and execute arbitrary code in the server process. A single tools/call is sufficient to escape the sandbox and achieve remote code execution as the server user, exposing everything the process holds such as OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata. Because the framework's DEFAULT_AUTH_OPTIONS is public mode, an unconfigured server serves this to unauthenticated callers, and on authenticated servers an indirect prompt injection in tool output or fetched content can trigger it without a human attackerThis issue is fixed in version 1.5.7.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-67531 since 07/29/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/06/2026). The MITRE ATT&CK project declares the attack technique as T1611.

Upgrading to version 1.5.7 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-53684). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Agentfront

Name

• FrontMCP

Version

• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3
• 1.5.4
• 1.5.5
• 1.5.6

Website

• Product: https://github.com/agentfront/frontmcp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion