EUVD-2026-86020
GHSA-v65w-6crh-cp3h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim connects mcp-remote to malicious MCP server
-
DeliveryServer returns crafted OAuth authorization URL
-
Exploitopen() invoked on unvalidated URL
-
ExecutionOS shell interprets malicious argument
-
ImpactArbitrary code execution on client host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | The victim must be running geelen mcp-remote versions 0.1.16 through 0.1.38 and must initiate a connection to an attacker-controlled or compromised remote MCP server; the vulnerable path is triggered when mcp-remote's OAuth flow passes a server-supplied authorization URL to open() without adequate browser-URL validation. Exploitation is limited by the required user action of connecting to a malicious server (UI:R) and by the trust model - it does not affect users who only connect to trusted first-party MCP servers. No authentication on the victim side is required (PR:N). |
| Impact | This is a genuinely high-severity client-side RCE, but with important limiting conditions. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) is internally consistent with the description: a remote attacker achieves arbitrary code execution, but UI:R correctly reflects that the victim must initiate a connection to an attacker-controlled or compromised remote MCP server. EPSS is low (0.29%, 19th percentile), there is no CISA KEV listing, and no exploit code is confirmed in the inputs - no public exploit identified at time of analysis, though a third-party security advisory (playb0t/mcp-remote-oauth-security, finding F-08 'browser-url-validation') describes the class of issue, indicating credible technical detail exists. The signals are consistent rather than conflicting: high technical impact (full RCE) tempered by a required social-engineering/trust step (connecting to a malicious server) and low observed exploitation probability. Net: treat as a real priority for anyone running the affected mcp-remote versions who connects to non-fully-trusted MCP servers, but it is not evidence of mass exploitation. Note the CPE string ('cpe:2.3:a:n/a:n/a') and EUVD affected-versions ('n/a n/a') are placeholders - affected range (0.1.16 through 0.1.38) comes only from the free-text description and is not corroborated by structured CPE data. |
| Exploit ScenarioDerived | A developer configures the mcp-remote bridge (v0.1.16-0.1.38) to connect their MCP client to a remote MCP server that is attacker-controlled or has been compromised. During the OAuth authorization flow, the server returns a crafted authorization URL that bypasses browser URL validation; mcp-remote passes it to the open() function without sanitization, causing the OS to execute attacker-supplied commands on the developer's host. No public exploit code is confirmed, though a detailed third-party advisory documents the browser-URL-validation weakness. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Remote code execution in mcp-remote 0.1.16 through 0.1.38 allows an attacker who controls or compromises a remote MCP server to run arbitrary code on a connected client by supplying a malicious OAuth authorization URL that the tool passes to open() without validation. Exploitation requires the victim to initiate a connection to that malicious server (user interaction, UI:R) and no victim-side authentication is required (PR:N); users who connect only to trusted first-party MCP servers are not affected. The EPSS score is low (0.29%, 19th percentile), no public exploit identified at time of analysis, and no CISA KEV confirmation of active exploitation.
RemediationAI
No vendor-released patch is identified in the provided intelligence at time of analysis; check the project's security advisories page (https://github.com/geelen/mcp-remote/security/advisories) for a fixed release and upgrade mcp-remote to a version outside the 0.1.16-0.1.38 range as soon as one is published. Until then, the most effective compensating control is to restrict mcp-remote usage to trusted, first-party MCP servers only, since exploitation requires the victim to initiate a connection to an attacker-controlled or compromised server; the trade-off is loss of access to third-party remote MCP integrations. If the tool exposes a setting to disable or manually confirm automatic browser launches of server-supplied OAuth authorization URLs, enable it - this adds friction to the OAuth flow but blocks the malicious open() call. Because the vector requires user interaction (UI:R), brief users not to connect mcp-remote to untrusted MCP servers and to treat unexpected browser launches during OAuth as suspicious. If no fix becomes available and third-party servers are required, consider network egress filtering or an alternative MCP transport, though these may break legitimate functionality.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
mcp-remote is an npm package that acts as a bridge between MCP (Model Context Protocol) clients and remote MCP servers, handling the OAuth flow used to authenticate to those servers. The vulnerability, classified as CWE-20 (Improper Input Validation), occurs when mcp-remote takes a server-supplied authorization URL from the OAuth handshake and passes it directly to the open() function to launch a browser, without validating the URL's scheme or destination. An attacker controlling a remote MCP server can therefore return a URL that triggers code execution on the client - for example, a file:// URI pointing to an executable or application bundle, a URL using a custom scheme registered to a dangerous handler, or an OS-specific path that open() resolves into execution. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects that the attack is network-reachable and low-complexity but requires the victim to connect to the malicious server, yielding high confidentiality, integrity, and availability impact. The provided CPE string (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) does not identify a specific product, so the affected component is best derived from the CVE description and the mcp-remote project (https://github.com/geelen/mcp-remote).
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote malicious server delivers the payload (AV:N, PR:N), but the victim must actively connect (UI:R); unvalidated open() yields full RCE, so C/I/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functions
Executive ViewAI
Organizations using mcp-remote versions 0.1.16 through 0.1.38 face a high-severity remote code execution risk when connecting to untrusted remote MCP servers. An unauthenticated attacker controlling such a server can execute arbitrary code on the connected client, though the victim must initiate the connection. This affects developers and systems relying on mcp-remote for MCP integrations, potentially leading to workstation compromise and lateral movement, which warrants management attention for risk mitigation and policy enforcement.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict mcp-remote client connections to trusted first-party MCP servers only; disable automatic or one-click connection to untrusted servers; monitor and block suspicious OAuth authorization URLs; implement network segmentation and egress filtering; use endpoint detection to alert on unexpected code execution from mcp-remote; and consider downgrading to mcp-remote version 0.1.15 or earlier if operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB