Agentfront vulnerabilities
We track 6 vulnerabilities in Agentfront products across 5 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on September 15, 2026.
Latest Agentfront vulnerabilities
- 8.5 High severity
frontmcp: Server-Side Request Forgery
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted
- 9.3 Critical severity
frontmcp: Improper Control of Generation of Code
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non-configurable, non-wr
- 7.5 High severity
frontmcp: Server-Side Request Forgery
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions
- 10.0 Critical severity
enclave: Improper Control of Generation of Code
Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to version 2.11.1, it is possible to escape the security boundraries set by `@enclave-vm/core`, which can be used to achieve remote code execution (RCE). The issue has been
- 8.8 High severity
enclave: Loop with Unreachable Exit Condition
Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.10.1, the existing layers of security in enclave-vm are insufficient: The AST sanitization can be bypassed with dynamic property accesses, the hardening of the error o
- 10.0 Critical severity
enclave: Improper Control of Generation of Code
Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js runt