MCPA-2025-0001
mcp-remote OS command injection via untrusted MCP server (CVE-2025-6514)
mcp-remote, the widely used npm proxy for connecting local MCP clients to remote MCP servers, is exposed to OS command injection when connecting to untrusted MCP servers. A malicious server can achieve remote code execution on the client machine via crafted input in the authorization_endpoint response URL during the OAuth flow.
A malicious MCP server can return a crafted `authorization_endpoint` URL (e.g. a `file:` URL such as `file:/c:/windows/system32/calc.exe` on Windows) that mcp-remote passes to the OS when opening the browser for authorization, resulting in arbitrary command execution. Full parameter control is possible on Windows; arbitrary program execution with limited parameter control on macOS/Linux. Fixed in mcp-remote 0.1.16 by validating the endpoint URL.
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | mcp-remote | >= 0.0.5, < 0.1.16 |
Identifiers
CVE-2025-6514GHSA-6xpm-ggf7-wc3pJFSA-2025-001290844CWE-78
References
- advisory https://nvd.nist.gov/vuln/detail/CVE-2025-6514
- advisory https://github.com/advisories/GHSA-6xpm-ggf7-wc3p
- report https://research.jfrog.com/vulnerabilities/mcp-remote-command-injection-rce-jfsa-2025-001290844/
- article https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability
- fix https://github.com/geelen/mcp-remote/commit/607b226a356cb61a239ffaba2fb3db1c9dea4bac
Timeline
- Published: 2025-07-09
Credits
- Or Peles (JFrog Security Research)