Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and args values (for example, command: bash with args: ['-c', 'touch /tmp/pwned']). When a user runs the forge CLI inside a cloned untrusted repository, the specified commands are spawned with the invoking user's privileges, resulting in arbitrary code execution. This provides a reliable initial-access and persistence primitive against developers who evaluate untrusted repositories with ForgeCode.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
ForgeCode (@forgecodehq) (AI pair-programming CLI) auto-executes MCP servers from .mcp.json on startup. CVE-2026-57860: clone a malicious repo, run the tool, get arbitrary code execution. CVSS 7.8 HIGH. Here's what matters:
Post summary
ForgeCode’s auto‑execution of MCP servers via .mcp.json enables arbitrary code execution when a malicious repository is cloned, illustrating a RCE CVE-2026‑57860 with a CVSS score of 7.8.
Check your stack: does your AI assistant, build tool, or dev CLI auto-load commands from repo config? If yes, that's your Sunday threat model exercise. https://nvd.nist.gov/vuln/detail/CVE-2026-57860
Post summary
The tweet references CVE-2026-57860 and highlights a potential risk of AI assistants auto‑loading commands from repo configuration, but it offers no detailed technical or exploitation information.