cfgaudit

Rules / CFG126

CFG126 an MCP launcher pins a known-vulnerable package version

Severity: error OWASP: LLM04:2026 – Supply Chain OWASP Agentic: ASI04:2026 – Agentic Supply Chain Vulnerabilities Agents: claude-code, cline, codex, continue, copilot, cursor, devin, devin-desktop, gemini-cli, goose, grok, junie, kimi-code, opencode, qwen-code, roo-code, vscode, zed

What cfgaudit checks

CFG126 compares exact npm package versions launched by MCP server entries with a small reviewed offline advisory table. It uses the same runner parsing as CFG010, including flags before the package, scoped packages, --package / -p, npx, npm exec, pnpm dlx, yarn dlx, bunx and pnpx, and the Windows forms npx.cmd and cmd /c npx.

The table, last reviewed 2026-11-07, contains:

Package Affected versions Fixed version Advisory
mcp-remote >=0.0.5 <0.1.16 0.1.16 CVE-2025-6514 / GHSA-6xpm-ggf7-wc3p
@modelcontextprotocol/inspector <0.14.1 0.14.1 CVE-2025-49596 / GHSA-7f8r-222p-6f5g
@modelcontextprotocol/inspector >=2.0.0 <=2.11.0 2.12.0 GHSA-q978-78c7-phqw; Windows and WSL only

Only a complete stable version (MAJOR.MINOR.PATCH, optionally prefixed by v or followed by build metadata) is compared. Tags, npm aliases, ranges, shortened versions, prereleases and malformed versions are left unknown. CFG010 separately reports a missing or floating pin; neither rule claims an unknown version is safe.

The scan is offline. Adding an entry requires a primary or vendor advisory, boundary tests, a reviewed date here, and an entry in docs/advisories.yml. The scheduled advisory check then reports an ID that is withdrawn or no longer published. Remove or revise an entry when that happens; do not silently widen a range.

Trigger example

{
  "mcpServers": {
    "remote": {
      "command": "npx",
      "args": ["-y", "mcp-remote@0.1.15", "https://example.invalid/mcp"]
    }
  }
}

Safe alternative

Upgrade to the fixed version or later after reviewing the package's current release notes:

{
  "mcpServers": {
    "remote": {
      "command": "npx",
      "args": ["-y", "mcp-remote@0.1.16", "https://example.invalid/mcp"]
    }
  }
}

References

Documentation for cfgaudit 1.21.0. Source of this page · Rule implementation