{"action":"Upgrade mcp-contextforge-gateway to 1.0.0 or later.","affected":[{"fixed":"1.0.0","introduced":"0"}],"component":"mcp-contextforge-gateway","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["1.0.0"],"ghsa_id":"GHSA-vwf3-4xxj-qg6h","id":"tcs_01M5KG0Z3CBGY0TFG5HS2SG5S2","modified_at":"2026-08-26T01:04:48.785581518Z","published_at":"2026-08-25T17:42:11Z","references":["https://osv.dev/vulnerability/GHSA-vwf3-4xxj-qg6h","https://github.com/IBM/mcp-context-forge/security/advisories/GHSA-vwf3-4xxj-qg6h","https://github.com/IBM/mcp-context-forge/issues/538","https://github.com/IBM/mcp-context-forge/pull/4072","https://github.com/IBM/mcp-context-forge/commit/4d31004661858a2e99055b3c0c9f14218b8f7120","https://github.com/IBM/mcp-context-forge","https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.0"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-vwf3-4xxj-qg6h","url":"https://osv.dev/vulnerability/GHSA-vwf3-4xxj-qg6h"}],"summary":"mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment"}