Junglewise Threat Intelligence

CVE-2026-57860: tailcallhq ForgeCode arbitrary code execution via untrusted .mcp.json

CVE-2026-57860 · Severity: high · CVSS 7.8 · Published 2026-07-17

Executive brief

ForgeCode is an AI-powered programming tool used by developers to assist with coding tasks. A security flaw allows a malicious project repository to automatically run unauthorized commands on a developer's computer if they open the project using the ForgeCode interface. This could allow an attacker to steal sensitive data, install persistent malware, or take full control of the developer's workstation.

Technical details

ForgeCode (tailcallhq/forgecode) is vulnerable to arbitrary code execution due to the insecure handling of the '.mcp.json' configuration file. The application automatically loads and executes commands defined in the 'mcpServers' section of this file upon startup within a repository directory, without requiring user confirmation or providing a trust prompt. An attacker can craft a malicious repository containing a '.mcp.json' file that specifies arbitrary system commands. When a user executes the 'forge' CLI inside such a repository, the commands are executed with the privileges of the invoking user. This vulnerability is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). A fix involving an interactive trust gate was introduced in commit 68ca3a3.

Affected products

  • tailcallhq ForgeCode 2.11.1 and earlier

Timeline

  • 2026-04-15: disclosed: Issue reported on GitHub repository
  • 2026-05-21: patched: Interactive trust prompt implemented in commit 68ca3a3
  • 2026-07-17: advisory: CVE published and NVD record created

References