EUVD-2026-86019
GHSA-mvq8-g2rm-4rhm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weak MD5 token isolation requires the victim to connect to a crafted/colliding server URL (UI:R) and a hash collision or predictable path (AC:H); primary impact is OAuth credential disclosure (C:H), with limited integrity and no availability impact, contradicting the input's RCE framing.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
7DescriptionCVE.org
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function
AnalysisAI
A credential-isolation flaw in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker who controls or can predict the MCP server URL a victim configures to cause MD5-derived credential-store paths to collide or match, potentially exposing or overwriting another server's cached OAuth tokens via the getServerUrlHash function in src/lib/utils.ts. The package is an npm bridge that connects local MCP clients to remote MCP servers, so practical exploitation depends on the victim adding the attacker's server URL and on the OAuth credential-persistence feature being in use (user interaction), which is inconsistent with the no-interaction AV:N/AC:L/PR:N/UI:N profile of the 9.8 headline score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Applies to geelen mcp-remote versions 0.1.16 through 0.1.38, an npm bridge that connects local MCP clients to remote MCP servers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The headline signals appear alarming - CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-94 code injection) describing unauthenticated remote arbitrary code execution - but the supporting intelligence contradicts a clean RCE reading. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis - the references point to the upstream repository and its security-advisories index, but no fixed release version is given, so do not assume 0.1.39 or any other version is remediated without confirming it there; treat the upstream advisory page as the authoritative tracking source and pin to a version explicitly listed as fixed once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all development and production systems for npm package mcp-remote versions 0.1.16 through 0.1.38, disable OAuth credential-persistence where possible, remove or block untrusted MCP server URLs, and rotate any cached OAuth tokens associated with those instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in pack
DNS rebinding against the local Streamable HTTP MCP listener in @zereight/mcp-gitlab before 2.1.30 lets a malicious web
Archive extraction in the Node.js decompress package allows a crafted archive containing chained symlink entries to reso
The legacy DOC renderer in File Viewer emits document-controlled hyperlink targets into generated HTML after character e
Untrusted git configuration includes reachable through simple-git before 4.0.0 let an attacker execute arbitrary command
A remote, unauthenticated denial-of-service condition in the NestJS (Nest) microservices framework lets an attacker cras
Deeply nested brace patterns cause unbounded recursion in the npm brace-expansion library, exhausting the native stack a
Stack exhaustion in the npm library brace-expansion (all versions prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10) lets a craf
The JavaScript library ip-address (npm) fails to treat the NAT64 local-use prefix 64:ff9b:1::/48 as private, so applicat
Cross-family subnet comparisons in the ip-address npm library (all versions before 10.7.1) can cause isInSubnet and isHo
Denial of service in the ip-address JavaScript/npm library (all versions prior to 10.7.1) lets remote attackers stall or
Code injection in orval's opt-in @orval/hono generator (all versions before 8.29.0) lets an attacker who controls an Ope
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today