CVE-2026-53710

MCP Context Forge's optional python_sandbox_server component, prior to version 1.2... 1.0.2, contains a Python sandbox escape: raw getattr is exposed through safe_builtins, a required _getattr_ guard is omitted, and the validate_code checks only block literal dangerous dunder strings. An attacker can construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute arbitrary OS commands with the server process's privileges by invoking the execute_code MCP tool. Deployments exposing the tool over the HTTP/SSE transport can be attacked without authentication (CVSS 10.0, network vector), whereas stdio-only deployments have reduced network reachability. Only the python_sandbox_server subproject is affected — the core Context Forge gateway and proxy components are not directly impacted — and the issue is fixed in version 1.0.2. No public proof of concept or in-the-wild exploitation is known at this time.

What to do: Upgrade python_sandbox_server to version 1.0.2 immediately. Until patched, remove the sandbox server from HTTP/SSE exposure (stdio-only transport sharply limits reachability) and disable or firewall the execute_code tool, since unauthenticated HTTP/SSE deployments amount to an open RCE endpoint. Review logs for unexpected execute_code invocations or spawned child processes, and rotate any secrets or credentials accessible to the server process.