ContextForge's own Python sandbox MCP server is a 10.0 escape: raw getattr in safe_builtins reaches subprocess.Popen

NVD·high signalXBlueskyLinkedInCopy link

CVE-2026-53710, published 2026-09-15, affects MCP Context Forge before 1.0.2. The `python_sandbox_server` exposes raw `getattr` through `safe_builtins`, omits the required `_getattr_` guard, and relies on `validate_code` checking for literal dangerous dunder strings. An attacker builds dunder names at runtime, walks the class hierarchy to `subprocess.Popen`, and runs OS commands as the server process; the HTTP/SSE transport can expose `execute_code` with no authentication at all. This is the sandbox meant to contain agent-generated code.