CVE-2026-67531: FrontMCP Sandbox Escape RCE Vulnerability

CVE-2026-67531 Overview

CVE-2026-67531 is a sandbox escape vulnerability in FrontMCP, a TypeScript-first framework implementing the Model Context Protocol (MCP). Versions prior to 1.5.7 expose live host Zod schema instances to sandboxed scripts through the codecall:execute tool. Because Zod v4 defines _zod as a non-configurable, non-writable own property, ECMAScript Proxy invariants force the security membrane to return the raw host object. A single tools/call request lets an attacker traverse _zod.constr.constructor to reach the host Function constructor and execute arbitrary code in the server process. The framework's DEFAULT_AUTH_OPTIONS set to public mode makes unconfigured servers exploitable by unauthenticated callers.

Critical Impact
Unauthenticated remote code execution on FrontMCP servers, exposing OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata.

Affected Products

FrontMCP framework versions prior to 1.5.7
FrontMCP servers running with DEFAULT_AUTH_OPTIONS (public mode)
Authenticated FrontMCP servers reachable via indirect prompt injection

Discovery Timeline

2026-08-06 - CVE CVE-2026-67531 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-67531

Vulnerability Analysis

The flaw is a code injection issue [CWE-94] in the FrontMCP sandbox membrane. FrontMCP exposes tool schemas to sandboxed job scripts through a getTool() helper. The security membrane wraps host objects in an ECMAScript Proxy to prevent scripts from touching host realm internals.

Zod v4 defines the _zod property on schema instances as a non-configurable, non-writable own property. The ECMAScript Proxy invariants require that get traps for such properties return the exact host value. The membrane cannot substitute a wrapped clone, so the raw host object crosses the sandbox boundary.

Once a script holds the raw _zod object, it can walk the prototype chain to _zod.constr.constructor. That reference is the host Function constructor, which compiles and returns a function executing in the host realm. A single tools/call invocation is sufficient to achieve remote code execution as the server user.

Root Cause

The root cause is a conflict between JavaScript language invariants and the sandbox design. Proxies cannot lie about non-configurable, non-writable own properties, so any host object carrying such a property leaks through membranes that rely on Proxy interception alone.

Attack Vector

Attackers reach the vulnerability over the network with no privileges and no user interaction. On public-mode servers, any client that can issue tools/call triggers the exploit. On authenticated servers, an indirect prompt injection embedded in tool output or fetched web content can drive an agent to call the vulnerable tool automatically.

typescript

// Security patch: libs/sdk/src/job/enclave/job-enclave.bridge.ts
// Copy a value the sandbox is about to receive into a fresh structure.
//
// These are structured-clone semantics, not JSON: reference cycles are preserved, `Date` /
// `Map` / `Set` survive as themselves, and a class instance arrives as a plain object with its
// prototype dropped rather than being rejected. Only genuinely non-cloneable values — a
// function or symbol, for example — throw here instead of crossing the sandbox boundary.
function toSandboxValue(value: unknown): unknown {
  try {
    return structuredClone(value);
  } catch {
    throw new Error('Value crossing the sandbox boundary is not structured-cloneable');
  }
}

Source: GitHub Commit 209cddd

Detection Methods for CVE-2026-67531

Indicators of Compromise

Unexpected tools/call requests targeting the codecall:execute tool from unauthenticated or unknown clients.
Server-side process spawns, outbound network connections, or filesystem writes originating from the FrontMCP job runtime.
Access to environment variables containing JWT_SECRET, OAuth secrets, or cloud instance metadata endpoints such as 169.254.169.254.

Detection Strategies

Inspect MCP request logs for tool calls whose script payload references _zod, constr.constructor, or Function( string literals.
Correlate FrontMCP job execution events with child-process creation or unexpected DNS lookups from the server host.
Alert on FrontMCP servers running versions prior to 1.5.7 detected in software inventory.

Monitoring Recommendations

Enable verbose logging on the FrontMCP sandbox bridge and forward events to a centralized log store for retention and analysis.
Monitor egress traffic from FrontMCP hosts to cloud metadata services and unusual external endpoints.
Track authentication configuration drift so that servers do not fall back to DEFAULT_AUTH_OPTIONS public mode in production.

How to Mitigate CVE-2026-67531

Immediate Actions Required

Upgrade FrontMCP to version 1.5.7 or later on every server and CLI installation.
Rotate all secrets accessible to the FrontMCP process, including JWT_SECRET, OAuth client secrets, session keys, and database credentials.
Audit cloud instance credentials and revoke any temporary tokens issued to affected hosts.

Patch Information

The fix ships in FrontMCP 1.5.7. The patch introduces structuredClone-based marshalling in libs/sdk/src/job/enclave/job-enclave.bridge.ts so that host objects, including Zod schemas, are converted to plain sandbox-safe values before crossing the membrane. Details are in the GitHub Security Advisory GHSA-mp29-fxh8-92px and the remediation commit.

Workarounds

Disable the codecall:execute tool until the upgrade to 1.5.7 completes.
Override DEFAULT_AUTH_OPTIONS to require authentication and restrict tool access to trusted clients only.
Place FrontMCP servers behind a network policy that blocks access to cloud instance metadata endpoints from the workload.

bash

# Upgrade FrontMCP to the patched release
npm install frontmcp@^1.5.7

# Verify the installed version
npm ls frontmcp