FrontMCP CodeCall sandbox escape CVE published to NVD at CVSS 9.3, three weeks after the GitHub advisory
A critical sandbox escape in FrontMCP's CodeCall plugin reached NVD on 2026-08-06, though the GitHub advisory itself was published 2026-07-26. The finding is that codecall:execute exposed live host Zod schema instances, and Zod v4's non-configurable _zod property forced Proxy invariants to return the raw host object, giving a path to the host Function constructor.
GitHub advisory GHSA-mp29-fxh8-92px, titled "CodeCall sandbox escape to
host RCE via live Zod schema exposed by getTool", was published
2026-07-26 at Critical, CVSS 9.3. The finding is that codecall:execute
exposed live host Zod schema instances, and Zod v4's non-configurable
_zod property forced Proxy invariants to return the raw host object,
giving a path to the host Function constructor. Affected package:
@frontmcp/plugin-codecall (npm) <= 1.5.6, patched 1.5.7.
NVD lists CVE-2026-67531 published 2026-08-06T00:16:53.733 at CVSS v4.0
9.3 CRITICAL
(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N),
source security-advisories@github.com, CWE-94. The CVSS 9.3 is
consistent across GHSA and NVD. The primary disclosure date is
2026-07-26; the August 6 NVD publication is why the item surfaces in
the later sweep window.
The advisory is absent from the global GitHub Advisory Database mirror
(github.com/advisories/GHSA-mp29-fxh8-92px returns 404). The
2026-07-26 date is corroborated by the frontmcp repository advisories
listing.
How was this verified, and what are the sources?
Published · last verified · confidence 0.90.
- NVD API record for CVE-2026-67531; published date and GitHub-assigned CVSS - accessed
- GitHub repository security advisory record; Published Jul 26 2026, Critical, CVSS 9.3, affected package and patched version - accessed
- frontmcp repo advisories listing showing 2026-07-26 for this GHSA - accessed
- Global GHSA mirror returns 404 for this ID - accessed