CyberRota Analysis
AI-GeneratedThe vulnerability exists in ForgeCode, where it automatically executes commands defined in a malicious .mcp.json file without user confirmation, allowing arbitrary code execution with the user's privileges. This poses a significant risk to developers who may inadvertently run the CLI in untrusted environments, potentially leading to unauthorized access and persistence in their systems. Organizations utilizing ForgeCode should prioritize patching or mitigating this vulnerability to protect their development environments from exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and args values (for example, command: bash with args: ['-c', 'touch /tmp/pwned']). When a user runs the forge CLI inside a cloned untrusted repository, the specified commands are spawned with the invoking user's privileges, resulting in arbitrary code execution. This provides a reliable initial-access and persistence primitive against developers who evaluate untrusted repositories with ForgeCode.