CVE-2026-53710

Unsafe raw getattr in python_sandbox_server lets attackers exec OS commands via crafted dunder names.

• CVSS 10.0
• 94
• Design Defects
• Remote

MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr through safe_builtins, omits a required _getattr_ guard, and relies on validate_code checks for literal dangerous dunder strings. An attacker can construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands with the server process privileges through the execute_code MCP tool. The HTTP/SSE transport can expose this tool without authentication, while stdio-only deployments have reduced network reachability. The issue affects the python_sandbox_server subproject and does not directly affect the core Context Forge gateway or proxy components. This issue is fixed in version 1.0.2.

CVE

CVE-2026-53710

CWE

94

CVSS base score

10.0

Published

2026-09-15

OWASP

A03 Injection

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Design Defects

Subcategory

Poorly Designed Access Controls

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Python

Fixed by upgrading

Yes

Solution

Upgrade the python_sandbox_server to version 1.0.2 (or later), which removes the unsafe getattr exposure and adds the missing _getattr_ guard.

import types

def _make_safe_builtins():
    # VULNERABLE: exposes raw getattr allowing dunder traversal
    safe_builtins = {
        "abs": abs,
        "len": len,
        "getattr": getattr,  # raw exposure
        "range": range,
    }
    return safe_builtins

def execute_user_code(source: str):
    """Execute untrusted Python code in a sandboxed namespace."""
    sandbox_globals = {"__builtins__": _make_safe_builtins()}
    sandbox_locals = {}
    exec(source, sandbox_globals, sandbox_locals)
    return sandbox_locals.get("result")

import types

def _make_safe_builtins():
    # FIX: wrap getattr with a guard against dunder names
    def safe_getattr(obj, name, default=None):
        if isinstance(name, str) and name.startswith("__"):
            raise AttributeError("Access to dunder attributes is prohibited")
        return getattr(obj, name, default)

    safe_builtins = {
        "abs": abs,
        "len": len,
        "getattr": safe_getattr,  # guarded exposure
        "range": range,
    }
    return safe_builtins

def execute_user_code(source: str):
    """Execute untrusted Python code in a sandboxed namespace."""
    sandbox_globals = {"__builtins__": _make_safe_builtins()}
    sandbox_locals = {}
    exec(source, sandbox_globals, sandbox_locals)
    return sandbox_locals.get("result")

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202653710,
  title        = {{Unsafe raw getattr in python_sandbox_server lets attackers exec OS commands via crafted dunder names.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-53710},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-53710/}}
}