CVE-2026-67531 agentfront CVE debrief

Who should care

Administrators and users of FrontMCP versions prior to 1.5.7, as well as security teams responsible for protecting against remote code execution vulnerabilities. They should review and restrict access to the codecall:execute tool, implement additional security measures to protect against remote code execution, and review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The sandboxed codecall:execute tool in FrontMCP versions prior to 1.5.7 exposes live host Zod schema instances, allowing a script to reach the host Function constructor and execute arbitrary code in the server process. This is caused by the tool exposing live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non-configurable, non-writable own property, the ECMAScript Proxy invariants force the security membrane to hand back the raw host object. A single tools/call is sufficient to escape the sandbox and achieve remote code execution as the server user, exposing everything the process holds.

Defensive priority

Immediate attention is required due to the critical severity of this vulnerability, which allows for remote code execution.

Recommended defensive actions

• Upgrade FrontMCP to version 1.5.7 or later
• Review and restrict access to the codecall:execute tool
• Implement additional security measures to protect against remote code execution
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from the NVD and CVE records indicates a critical vulnerability in FrontMCP versions prior to 1.5.7, allowing remote code execution due to exposure of live host Zod schema instances. The vulnerability is caused by the sandboxed codecall:execute tool exposing live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non-configurable, non-writable own property, the ECMAScript Proxy invariants force the security membrane to hand back the raw host object, letting a script reach _zod.constr.constructor (the host Function constructor) and execute arbitrary code in the server process. A single tools/call is sufficient to escape the sandbox and achieve remote code execution as the server user, exposing everything the process holds such as OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata. Because the framework's DEFAULT_AUTH_OPTIONS is public mode, an unconfigured server serves this to unauthenticated callers, and on authenticated servers an indirect prompt injection in tool output or fetched content can trigger it without a human attacker.

Official resources