MCP SERVER
Connect Everything to AI
Security & Production2026-07-193 min read

CVE-2025-6514: The Critical mcp-remote RCE, Explained

CVE-2025-6514 is a real, CVSS 9.6 critical vulnerability in mcp-remote that let a malicious MCP server trigger OS command execution on a connecting client via a crafted OAuth redirect URL. Here's exactly how it worked and how to check if you're affected.

Patching experiencesVulnerability reports
MCP Server Security: Complete Hardening ChecklistMCP Threat Model: What Attackers Are Looking ForMCP Server Exploits: Real Attack Scenarios

CVE-2025-6514 is a real, publicly disclosed, critical vulnerability — CVSS score 9.6 — found in mcp-remote, a widely used tool that lets MCP clients (Claude Desktop, VS Code, Cursor) connect to remote MCP servers over HTTP/SSE. It was discovered and disclosed by JFrog's security research team, and covered by The Hacker News, SentinelOne, Wiz, and GitHub's own Advisory Database (GHSA-6xpm-ggf7-wc3p). At the time of disclosure, mcp-remote had more than 437,000 downloads.

What Actually Went Wrong

The root cause is specific: mcp-remote mishandles the authorization_endpoint URL it receives during OAuth flow initialization. When a client connects to a malicious or compromised MCP server, that server can respond with a specially crafted authorization_endpoint value. When mcp-remote processes that value and passes it to the system's open() function (the mechanism used to launch the user's browser for the OAuth login step), a carefully constructed URL can inject and execute arbitrary OS commands on the machine running mcp-remote.

This is the exact failure mode this site's security guidance elsewhere warns about: trusting input from a remote MCP server (in this case, a URL used to open a browser) without treating it as untrusted, attacker-controlled data. A malicious server isn't hypothetical here — it's the entire attack surface CVE-2025-6514 exploits.

Who Was Affected

Versions 0.0.5 through 0.1.15 of mcp-remote are affected. Because mcp-remote sits in the connection path between popular AI clients and remote MCP servers, the practical impact reaches Claude Desktop, VS Code, Cursor, and any other client using it to reach an untrusted or attacker-controlled server — full system compromise is the realistic worst case, not an exaggeration, given the CVSS 9.6 rating.

The Fix

The vulnerability is patched in mcp-remote 0.1.16. If you have mcp-remote installed anywhere in your toolchain:

npm ls mcp-remote          # check what version you're running
npm install mcp-remote@latest   # or pin to >=0.1.16 explicitly

Beyond patching, the practical mitigation that matters regardless of version is the same principle covered throughout this site's security content: only connect mcp-remote (or any MCP client) to MCP servers you actually trust, and prefer HTTPS connections over plaintext HTTP for the transport itself.

Why This Case Is Worth Studying Even If You're Not Using mcp-remote

CVE-2025-6514 is a genuinely useful real-world case study for anyone building or operating MCP infrastructure, for one reason: it's a vulnerability in the client-side connection tooling, not the server. Most MCP security discussion focuses on servers over-trusting the model or under-scoping tool permissions; this CVE is a reminder that the client-side plumbing connecting to a server is just as much an attack surface, especially anywhere a remote server's response gets passed to a system-level function like a URL opener, a file writer, or a shell command.

Quick Reference

  • CVE: CVE-2025-6514
  • CVSS: 9.6 (Critical)
  • Component: mcp-remote
  • Affected versions: 0.0.5–0.1.15
  • Fixed in: 0.1.16
  • Root cause: Unvalidated authorization_endpoint URL passed to open() during OAuth flow, enabling OS command injection
  • Disclosed by: JFrog Security Research

Join the Discussion