Disclosed vulnerability
CVE-2025-6514: OS command injection in mcp-remote lets a malicious MCP server run code on the client OS
AIR-2025-0054 AIR record · 2025-07-mcp-remote-command-injection
From the supporting source
mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URLgithub.com
The record
Disclosed
2025-07-09
Vendor
Cloudflare / geelen (mcp-remote maintainers)
Product
mcp-remote (npm proxy used by Claude Desktop and other MCP clients)
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Privilege escalation
System type
Generative model
Who acted
Agent acted (contested) — the malicious MCP server ran code on the client through the agent's connection
Attack surface
MCP server
Autonomy level
Assistant
Initial vector
Malicious mcp server oauth authorization endpoint
Impact type
Remote code execution, Full host compromise, Arbitrary code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
mcp-remote 0.0.5-0.1.15; JFrog cited ~437,000 downloads of the package at disclosure time
Capability abused
Defense & remediation
Recorded defense
none - authorization_endpoint URL from the remote server was passed unsanitized to an OS command
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
mcp-remote 0.1.16
Taxonomy & references
Curator notes
CVSS 9.6 Critical. Found by JFrog Security Research (Or Peles). JFrog described it as the first documented full RCE on the client OS triggered by a remote MCP server. GHSA-6xpm-ggf7-wc3p / JFSA-2025-001290844. Also reported as: 'CVE-2025-6514: OS command injection in mcp-remote lets a malicious MCP server own the client machine'.
Supporting sources
Cite as
Enkrypt AI. "CVE-2025-6514: OS command injection in mcp-remote lets a malicious MCP server run code on the client OS". AIR, AIR-2025-0054. https://agentincident.vercel.app/i/AIR-2025-0054/ (accessed 2026-10-19).