Vulnerability · Published Jul 17, 2026 · Assigned by VulnCheck

CVE-2026-57860ForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted Repository

High 7.8

In plain English

A high-severity security flaw in forgecode from tailcallhq. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 88.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and args values (for example, command: bash with args: ['-c', 'touch /tmp/pwned']). When a user runs the forge CLI inside a cloned untrusted repository, the specified commands are spawned with the invoking user's privileges, resulting in arbitrary code execution. This provides a reliable initial-access and persistence primitive against developers who evaluate untrusted repositories with ForgeCode.

Affected products (as reported)

Vendor	Product	Versions
tailcallhq	forgecode	2.11.1

Weakness: CWE-829 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

GitHub Issue issue-tracking
GitHub Issue issue-tracking
Product product
Patch Commit patch
https://www.vulncheck.com/advisories/forgecode-arbitrary-code-execution-via-unvetted-mcp-json-in-untrusted-repository third-party-advisory