GHSA-vwf3-4xxj-qg6h: mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment
mcpgateway.services.prompt_service.PromptService renders user-supplied prompt templates using Jinja2’s plain Environment() rather than SandboxedEnvironment. An authenticated user with permission to register or update prompt templates can store a malicious template that, on subsequent rendering, executes arbitrary Python code on the gateway host with the privileges of the gateway process. This is a Server-Side Template Injection (SSTI) vulnerability leading to Remote Code Execution.
References
- github.com/IBM/mcp-context-forge/commit/4d31004661858a2e99055b3c0c9f14218b8f7120
- github.com/IBM/mcp-context-forge/issues/538
- github.com/IBM/mcp-context-forge/pull/4072
- github.com/IBM/mcp-context-forge/releases/tag/v1.0.0
- github.com/IBM/mcp-context-forge/security/advisories/GHSA-vwf3-4xxj-qg6h
- github.com/advisories/GHSA-vwf3-4xxj-qg6h
Code Behaviors & Features
Detect and mitigate GHSA-vwf3-4xxj-qg6h with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →