AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Am I affected by mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote…? What should I do?

    mcpgateway.services.prompt_service.PromptService renders user-supplied prompt templates using Jinja2's plain Environment() rather than SandboxedEnvironment.

    Affected: mcp-contextforge-gateway < 1.0.0 (0.1.0–0.9.0). Fixed in: 1.0.0. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/08/ghsa-vwf3-4xxj-qg6h-mcp-contextforge-gateway (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: mcp-contextforge-gateway < 1.0.0 (0.1.0–0.9.0). Fixed in: 1.0.0.

      • Check your version: run pip show mcp-contextforge-gateway. Versions < 1.0.0 of mcp-contextforge-gateway are affected.

      What to do now

      1. Upgrade to the fixed version: run pip install --upgrade "mcp-contextforge-gateway>=1.0.0" (first patched version 1.0.0).
      2. Upgrade to >= 1.0.0.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/08/ghsa-vwf3-4xxj-qg6h-mcp-contextforge-gateway (opens external site)

      Did this work for you?

    Add your answer or comment