CVE-2025-6514

CVE-2025-6514 is a critical OS command injection vulnerability (CWE-78, CVSS 9.6) in the mcp-remote tool, which bridges remote MCP (Model Context Protocol) servers into AI clients. It is triggered when mcp-remote connects to a malicious or untrusted MCP server: crafted data in the authorization_endpoint response URL supplied during the OAuth flow is executed as an operating system command. An attacker who controls or compromises an MCP server gains remote code execution on the host running mcp-remote with that user's privileges, potentially exposing enterprise secrets such as API keys, tokens, and local files. Affected users are developers and organizations running mcp-remote to connect AI agents and MCP clients to third-party MCP servers; the data does not specify affected version ranges. As of now there is no public proof-of-concept and it is not in CISA KEV, but the 77.9% EPSS score (100th percentile) indicates a very high probability of exploitation within 30 days.

What to do: Upgrade mcp-remote to the latest patched release per the JFrog/vendor advisory (exact fixed version is not specified in this data). Until patched, avoid pointing mcp-remote at untrusted or third-party MCP servers, and audit existing MCP server configurations for servers you do not control. Because the flaw executes commands during the authorization flow, also check hosts that ran mcp-remote for signs of unexpected command execution.