60
CVE-2025-6514
largeCritical OS Command Injection in mcp-remote Enables RCE via Untrusted MCP Servers
CVSS 3.1
9.6 critical
EPSS
78%p100
Published
()
Modified
AI analysis
CVE-2025-6514 is a critical OS command injection vulnerability (CWE-78, CVSS 9.6) in the mcp-remote tool, which bridges remote MCP (Model Context Protocol) servers into AI clients. It is triggered when mcp-remote connects to a malicious or untrusted MCP server: crafted data in the authorization_endpoint response URL supplied during the OAuth flow is executed as an operating system command. An attacker who controls or compromises an MCP server gains remote code execution on the host running mcp-remote with that user's privileges, potentially exposing enterprise secrets such as API keys, tokens, and local files. Affected users are developers and organizations running mcp-remote to connect AI agents and MCP clients to third-party MCP servers; the data does not specify affected version ranges. As of now there is no public proof-of-concept and it is not in CISA KEV, but the 77.9% EPSS score (100th percentile) indicates a very high probability of exploitation within 30 days.
What to do: Upgrade mcp-remote to the latest patched release per the JFrog/vendor advisory (exact fixed version is not specified in this data). Until patched, avoid pointing mcp-remote at untrusted or third-party MCP servers, and audit existing MCP server configurations for servers you do not control. Because the flaw executes commands during the authorization flow, also check hosts that ran mcp-remote for signs of unexpected command execution.
Affected
| mcp-remote project (npm package) mcp-remote | — |
Estimated exposure
large≈437,000+ downloads of the mcp-remote npm package — The estimate is based on the 437,000+ package downloads cited in disclosure coverage; download counts typically overstate unique active installations, but developer-tooling adoption of mcp-remote in agentic AI setups plausibly puts real…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL
- Weakness
- CWE-78
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
In the news4 stories
How MCP Servers Can Expose Enterprise Secrets
MCP servers holding AI agent credentials risk secret exposure via plaintext configs, credential sprawl, prompt injection, and over-permissioning; mitigations include centralization and least privilege.
The article examines how Model Context Protocol servers, which hold API keys, tokens, and service-account credentials for AI agents, can leak enterprise secrets. Documented exposure paths include plaintext credentials in config files, ungoverned credential sprawl, prompt injection, over-permissioning, and untrusted third-party servers. It cites CVE-2025-6514 in mcp-remote (400,000+ downloads), where a malicious server triggered OS command injection leading to remote code execution. Recommended mitigations include centralized secret stores, short-lived auto-rotated credentials, least privilege, and human approval for sensitive actions.
48
47
35