GHSA-vwf3-4xxj-qg6h: mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment
mcpgateway.services.prompt_service.PromptService renders user-supplied prompt templates using Jinja2’s plain Environment() rather than SandboxedEnvironment. An authenticated user with permission to register or update prompt templates can store a malicious template that, on subsequent rendering, executes arbitrary Python code on the gateway host with the privileges of the gateway process. This is a Server-Side Template Injection (SSTI) vulnerability leading to Remote Code Execution.
References
- github.com/IBM/mcp-context-forge/commit/4d31004661858a2e99055b3c0c9f14218b8f7120
- github.com/IBM/mcp-context-forge/issues/538
- github.com/IBM/mcp-context-forge/pull/4072
- github.com/IBM/mcp-context-forge/releases/tag/v1.0.0
- github.com/IBM/mcp-context-forge/security/advisories/GHSA-vwf3-4xxj-qg6h
- github.com/advisories/GHSA-vwf3-4xxj-qg6h
Code Behaviors & Features
Detect and mitigate GHSA-vwf3-4xxj-qg6h with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →