CVE-2026-57860
HIGH SEVERITYCVSS Score & Metrics
Base Score
7.8 / 10
Vector String
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability Description
ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and args values (for example, command: bash with args: ['-c', 'touch /tmp/pwned']). When a user runs the forge CLI inside a cloned untrusted repository, the specified commands are spawned with the invoking user's privileges, resulting in arbitrary code execution. This provides a reliable initial-access and persistence primitive against developers who evaluate untrusted repositories with ForgeCode.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-829
Source
NVD
Vendor
tailcallhq
Product
forgecode
External References
- https://github.com/tailcallhq/forgecode
- https://github.com/tailcallhq/forgecode/commit/68ca3a3a26c73c38a700453d3d021b5bbdc15dbd
- https://github.com/tailcallhq/forgecode/issues/3022
- https://github.com/tailcallhq/forgecode/issues/3252
- https://www.vulncheck.com/advisories/forgecode-arbitrary-code-execution-via-unvetted-mcp-json-in-untrusted-repository
- https://github.com/tailcallhq/forgecode/issues/3022
Discussion (0)
Add Comment
No comments yet. Be the first!