Five mcp-remote CVEs published against versions 0.1.16 through 0.1.38, two of them code execution.

NVD published CVE-2026-51994 through 51997 and CVE-2026-52001 on September 24 against geelen/mcp-remote, the stdio-to-remote MCP bridge a lot of clients depend on. The set covers SSRF through the resource_metadata URL in a server's WWW-Authenticate header, arbitrary code execution through getServerUrlHash and through the browser open() path, plus information leaks in OAuth metadata handling and the SSE fetch wrapper. They trace back to a seven-advisory OAuth trust-boundary review disclosed July 31. (NVD) The ownership detail matters as much as the CVEs: npm shows 0.1.39 and 0.2.0 from geelen in August, then from 0.10.0 on September 11 the package points at punkpeye/mcp-remote, now at 0.14.3. Anyone pinning mcp-remote in an MCP config should drop 0.1.38 and older, and should also confirm they're comfortable with who publishes it now.