Critical severity9.8NVD Advisory· Published Sep 24, 2026· Updated Sep 29, 2026

CVE-2026-51996

Description

An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Geelen/Mcp Remotellm-fuzzy
Range: 0.1.16 - 0.1.38

Patches

Vulnerability mechanics

References

github.com/geelen/mcp-remote/security/advisoriesnvd
github.com/playb0t/mcp-remote-oauth-security/blob/v1.0.1/advisories/F-04-md5-token-isolation.mdnvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000