CVE-2025-6514

mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorizationendpoint response URL...

Critical mcp-remote Vulnerability Enables Remote Code Execution, Impacting 437,000+ Downloads

Cybersecurity researchers have discovered a critical vulnerability in the open-source mcp-remote project that could result in the execution of arbitrary operating system OS commands. The vulnerability, tracked as CVE-2025-6514 , carries a CVSS score of 9.6 out of 10.0. "The vulnerability allows...

@wix/mcp-remote (>=0.0.2, <=0.0.6), mtmag (0.0.1) +3 more potentially affected by CVE-2025-6514 via mcp-remote (>=0.0.22, <=0.1.13)

mcp-remote NPM version =0.0.22, =0.0.2, =0.0.694, =0.0.1, =0.0.6 Source cves: CVE-2025-6514 Source advisory: OSV:GHSA-6XPM-GGF7-WC3P...

CVE-2025-6514

creationtimestamp| type| source ---|---|--- 2025-07-09 14:30:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ltjzp6d32j2y 2025-07-09 19:28:16+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3ltkke2mlwl2j 2025-07-09 19:30:45+00:00| seen|...

CVE-2025-6514

mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorizationendpoint response URL...

CVE-2025-6514 OS command injection in mcp-remote when connecting to untrusted MCP servers

mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorizationendpoint response URL...

CVE-2025-6514 OS command injection in mcp-remote when connecting to untrusted MCP servers

mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorizationendpoint response URL...