Tracking: GHSA-vwf3-4xxj-qg6h
Severity: High
Who is affected
The Python package mcp-contextforge-gateway before 1.0.0. The researcher verified 0.9.0. Exploitation requires an authenticated user permitted to register or update prompt templates.
How the attack works
PromptService renders stored templates with Jinja2's plain Environment() rather than a sandboxed environment. A malicious template can execute Python when another request renders it on the gateway.
This is server-side template injection. It does not require an LLM to obey a malicious instruction: the executable behavior occurs in the gateway's template engine, with that process's filesystem, network, and credential access.
What to do
- Upgrade to 1.0.0 or later and restart the gateway.
- Review stored prompt templates and changes made by template editors. Remove suspicious templates after preserving evidence, and check subsequent rendering activity.
- Limit template-management privileges and the gateway account's access. Investigate unexpected Python activity or outbound connections before assessing secret exposure.
Scope and limits
The reviewed GitHub advisory has no assigned CVE. Its tracking identifier is GHSA-vwf3-4xxj-qg6h.