mcp-remote exposed to OS command injection via untrusted MCP server connections

심각 9.6CVE-2025-6514 · GHSA-6xpm-ggf7-wc3p · Published 09/07/2025 · updated 17/06/2026

요약

CVE-2025-6514은(는) mcp-remote에 영향을 주는 심각 (CVSS 9.6) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 77.0%, 전체 취약점의 99.6%보다 높음.
조치: 0.1.16 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
mcp-remote npm	`≥ 0.0.5, < 0.1.16`	`0.1.16`

Description

mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL

NVD description

mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL

References

nvd.nist.gov/vuln/detail/CVE-2025-6514 · ADVISORY
geelen/mcp-remote commit 607b226 · WEB
geelen/mcp-remote · PACKAGE
jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability · WEB
research.jfrog.com/vulnerabilities/mcp-remote-command-injection-rce-jfsa-2025-001290844 · WEB
research.jfrog.com/vulnerabilities/mcp-remote-command-injection-rce-jfsa-2025-001290844

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free