Skip to content
OpenAdvisories

Product · tailcallhq

forgecode

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.8
    CVE-2026-57860

    ForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted Repository

    ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServer…

    tailcallhq forgecode