RCE in Agentfront Frontmcp
CVE-2026-67531
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non…
Vulnerability class: RCE (Remote Code Execution)
Affected products
- Agentfront Frontmcp — versions < 1.5.7
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)