FrontMCP versions before 1.5.7 expose live host Zod schema instances to sandboxed scripts via the getTool() method. Because Zod v4 defines the _zod property as non-configurable and non-writable, ECMAScript Proxy invariants cause the security membrane to return the raw host object. This allows scripts to reach _zod.constr.constructor, the host Function constructor, enabling arbitrary code execution on the server process. The default public mode authentication setting allows unauthenticated access, and indirect prompt injection can trigger exploitation even on authenticated servers. This vulnerability enables remote code execution with access to sensitive environment secrets such as OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud metadata. The issue is resolved in version 1.5.7.

Successful exploitation results in remote code execution as the server user, allowing attackers to access all data and secrets held by the process, including OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud instance metadata. This compromises the confidentiality and integrity of the server environment and its data.

Upgrade to frontmcp version 1.5.7 or later, where this vulnerability is fixed. No other mitigations are indicated. Patch status is not explicitly stated but the vendor has fixed the issue in version 1.5.7.