Improper Neutralization of Special Elements Used in a Template Engine Affecting mcp-contextforge-gateway package, versions [,1.0.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-MCPCONTEXTFORGEGATEWAY-20158877
- published27 Sept 2026
- disclosed25 Aug 2026
- creditUnknown
Introduced: 25 Aug 2026
CVE NOT AVAILABLE CWE-1336 (opens in a new tab)How to fix?
Upgrade mcp-contextforge-gateway to version 1.0.0 or higher.
Overview
mcp-contextforge-gateway is a ContextForge AI Gateway — an AI gateway, registry, and proxy for MCP, A2A, and REST/gRPC APIs. Exposes a unified control plane with centralized governance, discovery, and observability. Optimizes agent and tool calling, and supports plugins.
Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the PromptService._render_template process. An attacker can execute arbitrary code on the host system by supplying a crafted template to the API endpoints that register or update prompt templates, which is then rendered without sandboxing. This is only exploitable if the attacker has authenticated API access with permission to register or update prompts.