Five mcp-remote CVEs published against 0.1.16 to 0.1.38, including two code-execution bugs, and the npm package now builds from a different repo

NVD·high signalXBlueskyLinkedInCopy link

On 2026-09-24 NVD published CVE-2026-51994 through 51997 and CVE-2026-52001 against geelen/mcp-remote, the stdio-to-remote MCP bridge that many clients use. They cover SSRF through the resource_metadata URL in a server's WWW-Authenticate header, arbitrary code execution through getServerUrlHash and through the browser open() path, and information leaks in OAuth metadata handling and the SSE fetch wrapper. They come from a seven-advisory OAuth trust-boundary review (playb0t/mcp-remote-oauth-security) that was disclosed 2026-07-31. npm shows 0.1.39 on 08-21 and 0.2.0 on 08-24 from geelen, then from 0.10.0 on 09-11 the package points at punkpeye/mcp-remote (latest 0.14.3). Anyone pinning mcp-remote in MCP configs should drop 0.1.38 and older, and should check who they are now pulling from.