CVE-2026-51996
Critical · CVSS 9.8- CVSS
- 9.8
- nvd
- EPSS
- 0.78%
- 54th pct
- KEV
- No
- Class
- oss containerizable
- CWE-328
Description
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function
References
Status: profiled · ingested 2026-09-29T06:00:02.000Z