Threat database

Agentfront mcp-from-openapi versions from 2.2.0 up to but not including 2.9.0 contain a server-side request forgery (SSRF) vulnerability. This flaw allows attackers to bypass the denylist of blocked hosts by appending a trailing dot to hostnames, enabling unauthorized requests to operator-blocked hosts. The vulnerability arises from incomplete filtering of disallowed inputs in the OpenAPI specification URL or redirect targets.

A vulnerability in agentfront's mcp-from-openapi versions 2.5.0 up to but not including 2.9.0 allows attackers to capture Authorization and Cookie headers. This occurs because the safeFetch() function forwards these sensitive headers on cross-origin redirects, enabling attackers controlling a spec host or exploiting an open redirect to steal bearer tokens or cookies.

CVE-2026-67531 is a critical remote code execution vulnerability in the agentfront frontmcp framework prior to version 1.5.7. It arises from improper control of code generation due to exposure of live host Zod schema instances in sandboxed scripts. This allows an attacker to escape the sandbox and execute arbitrary code with the server user's privileges, potentially exposing sensitive secrets and credentials. The vulnerability is fixed in version 1.5.7.

CVE-2026-39885 is a Server-Side Request Forgery (SSRF) vulnerability in the frontmcp product by agentfront, specifically in versions prior to 1.0.4. The vulnerability arises because the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without restricting URLs or using custom resolvers. This allows malicious OpenAPI specs to cause the server to fetch internal network resources, cloud metadata endpoints, or local files during initialization, enabling SSRF and local file read attacks. The vulnerability has a high severity with a CVSS score of 7.5. No official patch or remediation level is explicitly stated in the provided data, but the description notes the issue is fixed in version 2.3.0 of the framework, which suggests upgrading to a fixed version is the recommended mitigation.

A critical code injection vulnerability (CWE-94) exists in agentfront's enclave, a secure JavaScript sandbox for AI agent code execution. Versions prior to 2.11.1 allow escaping the security boundaries of @enclave-vm/core, enabling remote code execution. This issue is fixed in version 2.11.1.

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.10.1, the existing layers of security in enclave-vm are insufficient: The AST sanitization can be bypassed with dynamic property accesses, the hardening of the error objects does not cover the peculiar behavior or the vm module and the function constructor access prevention can be side-stepped by leveraging host object references. This vulnerability is fixed in 2.10.1.

EPSS 0.2%Vulnerabilityagentfront#cwe-835Germany+7

CVE-2026-22686 is a critical sandbox escape vulnerability in the agentfront enclave JavaScript sandbox prior to version 2.7.0. It allows untrusted sandboxed JavaScript code to execute arbitrary code in the host Node.js runtime by exploiting the exposure of a host-side Error object and traversing its prototype chain to reach the host Function constructor. This enables attackers to bypass the sandbox isolation, gaining access to sensitive host resources such as environment variables, filesystem, and network. The vulnerability has a CVSS score of 10, indicating critical severity with no authentication or user interaction required. It is fixed in enclave version 2.7.0.

EPSS 0.8%Vulnerabilityagentfront#cwe-693#cwe-94Germany+7