CVE-2026-51996

Name of the Vulnerable Software and Affected Versions geelen mcp-remote versions 0.1.16 through 0.1.38

Description A code injection flaw exists in the getServerUrlHash() function within src/lib/utils.ts. This issue allows a remote attacker to execute arbitrary code on the host system by providing controlled input. This is only possible if the remote interface is exposed.

Recommendations Update geelen mcp-remote to a version newer than 0.1.38. As a temporary mitigation, disable the remote interface to prevent remote exploitation.