CVE-2026-57860

ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and args values (for example, command: bash with args: ['-c', 'touch /tmp/pwned']). When a user runs the forge CLI inside a cloned untrusted repository, the specified commands are spawned with the invoking user's privileges, resulting in arbitrary code execution. This provides a reliable initial-access and persistence primitive against developers who evaluate untrusted repositories with ForgeCode.

• CWE-829

• https://github.com/tailcallhq/forgecode
• https://github.com/tailcallhq/forgecode/commit/68ca3a3a26c73c38a700453d3d021b5bbdc15dbd
• https://github.com/tailcallhq/forgecode/issues/3022
• https://github.com/tailcallhq/forgecode/issues/3252
• https://www.vulncheck.com/advisories/forgecode-arbitrary-code-execution-via-unvetted-mcp-json-in-untrusted-repository
• https://github.com/tailcallhq/forgecode/issues/3022

Published

Jul 17, 2026

Last Modified

Jul 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57855Cockpit CMS contains a missing authorization vulnerability i…8.8
• CVE-2026-57856Cockpit CMS contains a path traversal vulnerability in the B…8.8
• CVE-2026-57857The Flow Payment plugin for WordPress (flow.cl) version 3.0.…5.1
• CVE-2026-57858Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a store…8.9
• CVE-2026-57859e107 prior to version 2.3.8 contains a code execution vulner…7.7
• CVE-2026-5786An Improper Access Control vulnerability in Ivanti EPMM befo…8.8
• CVE-2026-57862Kanboard 1.2.52 and prior contains a server-side request for…8.5
• CVE-2026-57863Crater Invoice through 6.0.6 contains a path traversal vulne…8.8
• CVE-2026-57866Server side request forgery in Apache Impala versions 4.4.x …8.8
• CVE-2026-57867MicroRealEstate allows adversaries to bypass authentication …8.8
• CVE-2026-57868MicroRealEstate is affected by broken object-level access co…7.1
• CVE-2026-57869Broken object-level access controls and the use of a determi…7.1