CVE-2026-57860

{"id": "CVE-2026-57860", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57860", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-17T16:45:24.963875Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "tailcallhq", "product": "forgecode", "versions": [{"status": "affected", "version": "2.11.1", "versionType": "git"}], "packageURL": "pkg:npm/forgecode", "defaultStatus": "affected"}]}], "published": "2026-07-17T17:17:16.777", "references": [{"url": "https://github.com/tailcallhq/forgecode", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/tailcallhq/forgecode/commit/68ca3a3a26c73c38a700453d3d021b5bbdc15dbd", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/tailcallhq/forgecode/issues/3022", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/tailcallhq/forgecode/issues/3252", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/forgecode-arbitrary-code-execution-via-unvetted-mcp-json-in-untrusted-repository", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/tailcallhq/forgecode/issues/3022", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-829"}]}], "descriptions": [{"lang": "en", "value": "ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and args values (for example, command: bash with args: ['-c', 'touch /tmp/pwned']). When a user runs the forge CLI inside a cloned untrusted repository, the specified commands are spawned with the invoking user's privileges, resulting in arbitrary code execution. This provides a reliable initial-access and persistence primitive against developers who evaluate untrusted repositories with ForgeCode."}, {"lang": "es", "value": "ForgeCode (tailcallhq/forgecode), una CLI de programaci\u00f3n en pareja con IA, carga y ejecuta autom\u00e1ticamente los servidores MCP definidos en el archivo .mcp.json de un repositorio al inicio sin confirmaci\u00f3n del usuario. Un repositorio malicioso puede proporcionar un archivo .mcp.json manipulado cuyas entradas mcpServers especifican valores arbitrarios para \u2019command\u2019 y \u2019args\u2019 (por ejemplo, command: bash con args: [\u2019-c\u2019, \u2019touch /tmp/pwned\u2019]). Cuando un usuario ejecuta la CLI de forge dentro de un repositorio no confiable clonado, los comandos especificados se ejecutan con los privilegios del usuario que invoca, lo que resulta en ejecuci\u00f3n de c\u00f3digo arbitrario. Esto proporciona un acceso inicial y una primitiva de persistencia confiables contra desarrolladores que eval\u00faan repositorios no confiables con ForgeCode."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "disclosure@vulncheck.com"}