Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
mcpgateway.services.promptservice.PromptService renders user-supplied prompt templates using Jinja2's plain Environment() rather than SandboxedEnvironment. An authenticated user with permission to register or update prompt templates can store a malicious template that, on subsequent rendering, executes arbitrary Python code on the gateway host with the privileges of the gateway process. This is a Server-Side Template Injection (SSTI) vulnerability leading to Remote Code Execution. Details Affected component: mcpgateway/services/promptservice.py Affected version: 0.9.0 (verified). The fix in the unreleased main branch indicates all earlier published versions are likewise affected. Vulnerable code mcpgateway/services/promptservice.py, line 26: mcpgateway/services/promptservice.py, line 135 (inside PromptService.init): mcpgateway/services/promptservice.py, lines 1592–1616 (rendertemplate): rendertemplate is invoked from PromptService.getprompt (line 892): Where prompt.template…
Recommended action: Upgrade to 1.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Commit: f855e54d5b7bc1c91b977574a03b91eff6b86bb6 Component: mcp-servers/python/pythonsandboxserver/src/pythonsandboxserver/serverfastmcp.py Vulnerability RestrictedPython's sandbox in ContextForge's pythonsandboxserver sub-project allows arbitrary Python execution via three compounding weaknesses: 1. Raw getattr is exposed in safebuiltins, bypassing getattr mediation. 2. validatecode checks for literal dangerous dunder strings, but the payload constructs those names at runtime. 3. The executecode MCP tool can be exposed over HTTP/SSE transport with no authentication layer. Proof of Concept The local PoC was executed against the real pinned sandbox code path. It constructs dunder names at runtime, walks Python's class hierarchy through the exposed getattr, finds subprocess.Popen, and executes a harmless marker command. Transcript excerpt: PoC artifact hashes: Production Deployment Context ContextForge's documentation describes registering MCP servers as gateways in a running…
Recommended action: Upgrade to 1.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The /admin/gateways/test endpoint validates submitted URLs by resolving the hostname at validation time and blocking private address ranges. The HTTP client independently re-resolves DNS at connection time with no IP binding between the two operations, creating a TOCTOU window exploitable via DNS rebinding. The source code explicitly acknowledges this limitation in two separate locations. Details validategatewaytesturl() in mcpgateway/common/validators.py (lines 1527–1710) calls socket.getaddrinfo() on the submitted hostname, checks whether the resolved IP falls in private, loopback, link-local, or cloud-metadata ranges (including 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16), and accepts the URL if the result is clean. The validated URL is then passed to the HTTP client as the original hostname string, not as the validated IP address. The HTTP client (httpx, via ResilientHttpClient) performs its own independent DNS resolution at connection time. No…
Recommended action: Upgrade to 1.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.