Skip to content
OpenAdvisories

Product · agentfront

frontmcp

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.3
    CVE-2026-67531

    FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool

    FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non-configurable, non-w…

    agentfront frontmcp