IBM mcp-context-forge versions before 1.0.2 contain a code injection vulnerability in the python_sandbox_server subproject. The server exposes raw getattr through safe_builtins without the required _getattr_ guard and relies on insufficient validate_code checks for dangerous dunder strings. Attackers can dynamically construct dunder names to traverse the Python class hierarchy, reach subprocess.Popen, and execute arbitrary OS commands with the privileges of the server process via the execute_code MCP tool. The HTTP/SSE transport can expose this tool without authentication, increasing the attack surface. The issue is resolved in version 1.0.2.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary operating system commands with the privileges of the python_sandbox_server process. This can lead to full system compromise, data loss, or disruption of service. The vulnerability affects only the python_sandbox_server subproject and not the core gateway or proxy components.

Upgrade to IBM mcp-context-forge version 1.0.2 or later, where this vulnerability is fixed. Until upgrading, restrict network access to the python_sandbox_server, especially the HTTP/SSE transport, to trusted users only. No other official mitigations are documented.