A sandbox escape in FrontMCP’s codecall:execute tool allows a script to access the host’s Zod schema instance. The Zod library exposes a protected _zod property that, when exposed through the insecure getTool() function, gives a script a reference to the host’s Function constructor. From that reference an attacker can run arbitrary JavaScript code in the server process. The resulting remote code execution exposes all data the process holds, including OAuth client secrets, JWT secret strings, session keys, database credentials, and cloud instance metadata.

The vulnerability exists in the agentfront:frontmcp framework in all releases prior to version 1.5.7. The framework is a TypeScript‑first Model Context Protocol implementation. When the default authentication option is set to public, an unconfigured server allows unauthenticated callers to trigger the vulnerability; on authenticated servers, indirect prompt injection can also trigger it without direct user interaction.

With a CVSS score of 9.3 the risk is considered critical. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via a crafted tool invocation that uses getTool() to retrieve the live Zod schema. The attacker only needs to send a single tool call; unauthenticated access is possible when DEFAULT_AUTH_OPTIONS is left on public mode. Successful exploitation results in full compromise of the server process.