Critical mcp-remote Vulnerability Enables Remote Code Execution, Impacting 437,000+ Downloads

🗓️ 10 Jul 2025 17:03:00Reported by The Hacker NewsType

thn🔗 thehackernews.com👁 10 Views

Critical mcp-remote vulnerability allows remote code execution, impacting over 437,000 downloads.

Reporter	Title	Published	Views	Family All 83
BDU FSTEC	The vulnerability of the mcp-remote proxy server lies in its failure to eliminate special elements used in the operating system command, allowing attackers to execute arbitrary commands.	4 Aug 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the file server, related to incorrect restrictions on the path to the restricted directory, allows a hacker to bypass security restrictions.	4 Aug 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the MCP protocol of the server-filesystem allows a perpetrator to gain unauthorized access to protected information.	4 Aug 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the mcp dev tool for testing and debugging MCP servers, MCP Inspector, allows a attacker to perform a CSRF attack.	4 Aug 202500:00	–	bdu_fstec
Circl	CVE-2025-49596	13 Jun 202520:35	–	circl
Circl	CVE-2025-53109	2 Jul 202516:56	–	circl
Circl	CVE-2025-53110	2 Jul 202517:24	–	circl
Circl	CVE-2025-6514	9 Jul 202514:30	–	circl
CNNVD	MCP Inspector 访问控制错误漏洞	13 Jun 202500:00	–	cnnvd
CNNVD	mcp-remote 操作系统命令注入漏洞	9 Jul 202500:00	–	cnnvd

11 Jul 2025 04:05Current

10High risk

Vulners AI Score10

CVSS 49.4

CVSS 3.19.6

EPSS0.77499

SSVC

mcp-remote vulnerability remote code execution cve-2025-6514 system compromise open-source project