Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

Fix availableCritical · CVSS 10EPSS 1.1%

Published Aug 24, 2026 · updated Oct 15, 2026

What to do

  1. Upgrade to a fixed version: mcp-contextforge-gateway 1.0.2.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPImcp-contextforge-gateway

Vulnerable versions
<= 1.0.1
Fixed in
1.0.2

Check your project: pip show mcp-contextforge-gateway

Sources

CWE-94 Improper Control of Generation of Code ('Code Injection') · CWE-693 Protection Mechanism Failure

← All critical vulnerabilities