FrontMCP codecall:execute Sandbox Escape via Zod Proxy Leak (CVE-2026-67531)

Technical Analysis

The codecall:execute tool runs untrusted scripts inside a sandbox that exposes tool schemas via getTool(), intended to be wrapped in a security-enforcing Proxy. Zod v4 defines the internal _zod property as non-configurable and non-writable, which under ECMAScript Proxy invariant rules forces the proxy to return the raw underlying object instead of a wrapped/restricted version when that property is accessed. This lets an attacker-controlled script traverse _zod.constr.constructor to obtain the host's real Function constructor, breaking out of the sandbox to execute arbitrary JavaScript in the server process with the privileges of the server user. The entry point is a single MCP tools/call request; because DEFAULT_AUTH_OPTIONS ships in public mode, unconfigured servers accept this from any unauthenticated caller, and on authenticated servers the same primitive can be reached passively through tool output or fetched content laced with an indirect prompt injection, meaning an LLM agent invoking the tool on poisoned data can trigger RCE without operator action.

Affected Systems

FrontMCP; protocols: MCP

Detection Signatures

• Tool call logs invoking codecall:execute followed by anomalous outbound network activity or file system access
• Script payloads referencing getTool(), _zod, constr.constructor, or Function constructor access patterns
• MCP servers running FrontMCP versions prior to 1.5.7
• Unauthenticated tools/call requests reaching servers with DEFAULT_AUTH_OPTIONS left in public mode
• Unexpected process spawning, credential file reads, or cloud metadata endpoint requests (e.g., 169.254.169.254) originating from the MCP server process
• Tool output or fetched external content containing embedded script/code fragments intended for sandbox execution

Remediation Steps

1. 1

   Upgrade FrontMCP

   Update to FrontMCP version 1.5.7 or later, which fixes the Proxy invariant leak in the codecall:execute sandbox.

2. 2

   Disable public auth mode by default

   Explicitly configure authentication requirements for MCP servers; do not rely on DEFAULT_AUTH_OPTIONS and require authenticated, authorized callers for all tool invocations.

3. 3

   Restrict or remove codecall:execute

   Disable arbitrary code execution tools where not strictly necessary, or run them in a fully isolated process/container/VM with no access to secrets, credentials, or cloud metadata endpoints.

4. 4

   Sanitize and isolate tool schema exposure

   Avoid exposing live host objects (including Zod schemas) to sandboxed scripts; use deep-cloned or fully immutable representations instead of Proxy-wrapped live references.

5. 5

   Rotate exposed secrets

   Rotate OAuth client secrets, JWT signing keys, session keys, and database credentials on any server that ran a vulnerable version prior to patching.

6. 6

   Harden against indirect prompt injection

   Treat tool output and fetched external content as untrusted input; implement content filtering/sanitization before it can influence tool invocation arguments or trigger code execution paths.