ForgeCode automatically loads and executes the MCP servers defined in a repository's .mcp.json file when the CLI starts, without prompting the user. This flaw, identified as CWE-829, allows an attacker to craft the mcpServers entries to include arbitrary command and argument values, which are then spawned as processes with the invoking user's privileges. This enables an attacker to run arbitrary code on the local machine, providing high‑severity compromise and persistence for developers evaluating untrusted repositories.

The vulnerability affects the TailcallHQ ForgeCode AI pair‑programming CLI. No specific product version information was provided; the issue applies to the current codebase in the GitHub repository.

The CVSS score of 8.4 rates this flaw as high severity. The EPSS score of less than 1% indicates a low but non‑zero probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The likely vector is inferred to be a local attacker who runs ForgeCode inside a cloned untrusted repository; no network‑based attack is described. Exploitation requires the user to execute the command line tool, and thus the impact is limited to systems where the tool is run but can be catastrophic given its arbitrary execution capability.