GHSA-VWF3-4XXJ-QG6H: Server-Side Template Injection in mcp-contextforge-gateway

Vulnerability ID: GHSA-VWF3-4XXJ-QG6H
CVSS Score: 9.8
Published: 2026-08-25

A Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) was discovered in the mcp-contextforge-gateway package before version 1.0.0. The vulnerability stems from an unsandboxed Jinja2 template rendering environment combined with an unsafe fallback mechanism using Python's native str.format() function. Attackers with template modification access could bypass static regex filters to execute arbitrary commands on the hosting platform.

TL;DR

Unsandboxed Jinja2 rendering and an unsafe str.format() fallback in mcp-contextforge-gateway prior to v1.0.0 permit remote code execution via crafted prompt templates.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-1336, CWE-94
Attack Vector: Network (with template registration privileges)
CVSS v3.1 Score: 9.8 (Critical)
Exploit Status: Proof-of-Concept
Patch Status: Patched in v1.0.0
Vulnerability Class: Server-Side Template Injection (SSTI)

Affected Systems

mcp-contextforge-gateway < 1.0.0
mcp-context-forge integrations utilizing prompt_service templates < 1.0.0
mcp-contextforge-gateway: < 1.0.0 (Fixed in: 1.0.0)

Code Analysis

Commit: 4d31004

Implement SandboxedEnvironment for Jinja2 template rendering, add pre-flight validation rules, and fix str.format fallback vulnerability

Exploit Details

GitHub Advisory: Original security disclosure highlighting the SSTI vulnerability and validation bypass.

Mitigation Strategies

Upgrade mcp-contextforge-gateway to version 1.0.0 or higher.
Ensure environment-level template validation variables are enabled.
Enforce strict network segmentation and access controls on prompt management endpoints.

Remediation Steps: