Skip to content

July 9, 2025Critical (CVSS 9.6, GitHub Advisory Database)Command injection

CVE-2025-6514: mcp-remote OS command injection (0.0.5 to 0.1.15)

Product: mcp-remote (npm)
CVE: CVE-2025-6514
Affected: >= 0.0.5, < 0.1.16
Fixed in: 0.1.16

Last verified against sources: October 16, 2026

What happened

According to GitHub Advisory Database's advisory (July 9, 2025), mcp-remote, a tool MCP clients use to connect to remote MCP servers, was exposed to OS command injection when connecting to an untrusted MCP server. [1]
A malicious MCP server could trigger it by replying with a specially crafted authorization_endpoint URL during the OAuth flow. [2]

Impact

JFrog rated it critical (CVSS 9.6). On Windows it led to arbitrary OS command execution; on macOS and Linux, to execution of arbitrary executables with limited parameter control. [2]

What was done

Fixed in mcp-remote 0.1.16. Versions 0.0.5 to 0.1.15 are affected. [1][2]

How to protect yourself

Upgrade mcp-remote to 0.1.16 or later. [1]
Only connect to trusted MCP servers, using HTTPS. [2]

Sources

GHSA-6xpm-ggf7-wc3p — GitHub Advisory Database
Critical RCE Vulnerability in mcp-remote: CVE-2025-6514 — JFrog Security Research

Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.

Corrections

Report an error or request a correction. We review requests within 5 business days and add a dated correction note.

← All incidents