PT-2025-28894 · Unknown · Mcp-Remote

Or Peles · Published 2025-06-17 · Updated 2026-04-17 · CVE-2025-6514

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions mcp-remote versions 0.0.5 through 0.1.15

Description mcp-remote is susceptible to OS command injection due to crafted input from the authorization endpoint response URL when connecting to untrusted MCP servers. This vulnerability allows attackers to execute arbitrary commands on the system. The vulnerability affects approximately 437,000+ downloads. This is the first documented real-world remote code execution case in the MCP ecosystem.

Recommendations Update mcp-remote to version 0.1.16 or later.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-09316

CVE-2025-6514

GHSA-6XPM-GGF7-WC3P

Affected Products

Mcp-Remote

References · 86

• https://github.com/geelen/mcp-remote/commit/607b226a356cb61a239ffaba2fb3db1c9dea4bac · Patch
• https://bdu.fstec.ru/vul/2025-09316 · Security Note
• https://osv.dev/vulnerability/GHSA-6xpm-ggf7-wc3p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6514 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6514 · Security Note
• https://github.com/geelen/mcp-remote · Note
• https://twitter.com/wild_reptilians/status/1943688203094970870 · Twitter Post
• https://twitter.com/akaclandestine/status/2003031230711779767 · Twitter Post
• https://twitter.com/Pete_yes_please/status/2035101036118003828 · Twitter Post
• https://twitter.com/bartek_boniecki/status/2012237210150412436 · Twitter Post
• https://t.me/thebugbountyhunter/10458 · Telegram Post
• https://twitter.com/rocklambros/status/2017266628812300335 · Twitter Post
• https://twitter.com/freedomhack101/status/1943666272677548123 · Twitter Post
• https://research.jfrog.com/vulnerabilities/mcp-remote-command-injection-rce-jfsa-2025-001290844 · Note
• https://twitter.com/marcel_butucea/status/1968810167157371019 · Twitter Post