DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-VWF3-4XXJ-QG6H: GHSA-VWF3-4XXJ-QG6H: Server-Side Template Injection in mcp-contextforge-gateway

#security #cve #cybersecurity #ghsa

GHSA-VWF3-4XXJ-QG6H: Server-Side Template Injection in mcp-contextforge-gateway

Vulnerability ID: GHSA-VWF3-4XXJ-QG6H
CVSS Score: 9.8
Published: 2026-08-25

A Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) was discovered in the mcp-contextforge-gateway package before version 1.0.0. The vulnerability stems from an unsandboxed Jinja2 template rendering environment combined with an unsafe fallback mechanism using Python's native str.format() function. Attackers with template modification access could bypass static regex filters to execute arbitrary commands on the hosting platform.

TL;DR

Unsandboxed Jinja2 rendering and an unsafe str.format() fallback in mcp-contextforge-gateway prior to v1.0.0 permit remote code execution via crafted prompt templates.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-1336, CWE-94
  • Attack Vector: Network (with template registration privileges)
  • CVSS v3.1 Score: 9.8 (Critical)
  • Exploit Status: Proof-of-Concept
  • Patch Status: Patched in v1.0.0
  • Vulnerability Class: Server-Side Template Injection (SSTI)

Affected Systems

  • mcp-contextforge-gateway < 1.0.0
  • mcp-context-forge integrations utilizing prompt_service templates < 1.0.0
  • mcp-contextforge-gateway: < 1.0.0 (Fixed in: 1.0.0)

Code Analysis

Commit: 4d31004

Implement SandboxedEnvironment for Jinja2 template rendering, add pre-flight validation rules, and fix str.format fallback vulnerability

Exploit Details

  • GitHub Advisory: Original security disclosure highlighting the SSTI vulnerability and validation bypass.

Mitigation Strategies

  • Upgrade mcp-contextforge-gateway to version 1.0.0 or higher.
  • Ensure environment-level template validation variables are enabled.
  • Enforce strict network segmentation and access controls on prompt management endpoints.

Remediation Steps:

  1. Check installed package version using pip show mcp-contextforge-gateway.
  2. Run pip install --upgrade mcp-contextforge-gateway>=1.0.0.
  3. Configure CONTENT_VALIDATE_PROMPT_TEMPLATES=true in environment configuration.
  4. Restart the gateway service to load the secure configuration.

References

Read the full report for GHSA-VWF3-4XXJ-QG6H on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)