mcp-audit
mcp-audit
1 unfixed CVE The mcp-audit verdict for mcp-remote
(npm), rendered from the same JSON the API serves.
| Maintainer | punkpeye (from 0.2.5, 2026-08-26; earlier releases geelen/mcp-remote) |
|---|---|
| Verified publisher | no |
| Entry last verified | 2026-10-13 |
| Hash pins available | no |
| Repository | https://github.com/punkpeye/mcp-remote |
| CVE | CVSS | Summary | Fixed in |
|---|---|---|---|
| CVE-2026-51994 | — | SSRF via the resource_metadata URL in a remote server's WWW-Authenticate header (0.1.32–0.1.38; first unaffected release 0.1.39). | 0.1.39 |
| CVE-2026-51995 | — | Information disclosure through authorization-server metadata handling (0.1.32–0.1.38; first unaffected release 0.1.39). | 0.1.39 |
| CVE-2026-51996 | — | Remote code execution through getServerUrlHash in src/lib/utils.ts (0.1.16–0.1.38; first unaffected release 0.1.39). | 0.1.39 |
| CVE-2026-51997 | — | Remote code execution through open() handling (0.1.16–0.1.38; first unaffected release 0.1.39). | 0.1.39 |
| CVE-2026-52001 | — | Information disclosure through the SSE transport's eventSourceInit fetch wrapper (0.1.18–0.1.38; first unaffected release 0.1.39). | 0.1.39 |
| CVE-2026-108716 | — | Cleartext transmission in 0.8.0 through 0.14.3; no patched version recorded (GHSA-jrvg-vw6c-rp59). | no fix published |
| CVE-2025-6514 | — | mcp-remote exposed to OS command injection via untrusted MCP server connections | 0.1.16 |
Sources: OSV and GitHub Security Advisories, linked per advisory. A fixed advisory affects only versions below its fix.
Capability tags come from mcp-audit's curated registry and drive its cross-server toxic-flow analysis.
This page describes the public package. What matters is your deployment — run the full check locally:
pip install mcp-audit-scanner mcp-audit check
