PyPI/mcp-contextforge-gateway: high

mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment

Action: Upgrade mcp-contextforge-gateway to 1.0.0 or later.

pip install mcp-contextforge-gateway==1.0.0

Affected

Fixed versions

Sources

• osv: GHSA-vwf3-4xxj-qg6h
• https://github.com/IBM/mcp-context-forge/security/advisories/GHSA-vwf3-4xxj-qg6h
• https://github.com/IBM/mcp-context-forge/issues/538
• https://github.com/IBM/mcp-context-forge/pull/4072
• https://github.com/IBM/mcp-context-forge/commit/4d31004661858a2e99055b3c0c9f14218b8f7120
• https://github.com/IBM/mcp-context-forge
• https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.0

published 2026-08-25T17:42:11Z · modified 2026-08-26T01:04:48.785581518Z · JSON