All packages
mcp-remote vulnerabilities
4 known CVE vulnerabilities in mcp-remote, translated and rated.
- CVE-2026-52001Unknown
An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper in src/lib/utils.ts.
- CVE-2026-51997Unknown
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functions.
- CVE-2026-51996Unknown
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function.
- CVE-2026-51994Unknown
mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Authenticate header.