Security Digest · Jul 9, 2025 · Vulnerability · AI agent tooling
mcp-remote: OS Command Injection via OAuth Endpoint
mcp-remote 0.0.5-0.1.15 runs attacker commands when it connects to a malicious MCP server (CVE-2025-6514, CVSS 9.6). Fixed in 0.1.16. Check pinned configs.
Our verdict
Check exposure
The fix is more than a year old, but version-pinned MCP client configs and stale npx caches can keep a vulnerable mcp-remote alive, so confirm the version and move on.
Who must act: Anyone whose Claude Desktop, Cursor, Windsurf or other MCP client config launches mcp-remote at a version below 0.1.16, especially on Windows.
Who can relax: Users who run mcp-remote 0.1.16 or later, or who don't use mcp-remote at all.
- Affected
- mcp-remote 0.0.5 through 0.1.15
- Fixed in
- mcp-remote 0.1.16
- CVSS
- 9.6 (v3.1, CNA)
- EPSS
- 77.0% (percentile 99.6)
- CISA KEV
- Not listed
- Exploitation
- Public proof-of-concept
- Severity
- Critical
What to do
- Grep MCP client configs (claude_desktop_config.json, .cursor/mcp.json, etc.) for `mcp-remote` and note any pinned version.
- Change pins to `mcp-remote@latest` or an explicit version at or above 0.1.16.
- Clear stale npx copies (`npm cache clean --force`, or delete the `_npx` directory under the npm cache) so an old cached build isn't reused.
- Connect only to MCP servers you trust, and only over HTTPS.
- On Windows, treat any previous connection to an unknown MCP server through an old mcp-remote as a possible compromise.
How to check if you are affected or compromised
- Run `npm ls -g mcp-remote` and search the npm `_npx` cache for mcp-remote package.json files with versions below 0.1.16.
- Review MCP client logs for OAuth discovery against unfamiliar server URLs.
- On Windows, hunt for PowerShell processes spawned by node.exe with unusual arguments around the time an MCP connection was made.
What happened#
On July 9, 2025, JFrog Security Research disclosed CVE-2025-6514, an OS command injection in mcp-remote. The npm package is a proxy that lets MCP hosts such as Claude Desktop, which mostly speak local stdio, connect to remote MCP servers over HTTP, and it also handles OAuth for them. The CNA (JFrog) scored it CVSS 3.1 9.6.
The bug sits in the OAuth flow. As JFrog's write-up explains, the remote server answers the first request with a 401, and mcp-remote fetches the server's OAuth metadata. A malicious server can return a crafted authorization_endpoint. mcp-remote passes that value to the open npm package to launch a browser. On Windows, open goes through PowerShell, where the crafted value turns into arbitrary command execution with full control of the arguments. On macOS and Linux, JFrog showed that an attacker could launch arbitrary executables with only limited control over arguments, and said full command execution "may be achievable." JFrog's advisory page includes a proof of concept that uses a file: URL to run a local program.
Who is affected#
mcp-remote versions 0.0.5 through 0.1.15. The fix arrived in 0.1.16, which The Hacker News reports was released on June 17, 2025, three weeks before public disclosure. The referenced fix commit URL-encodes user and password components in the sanitized URL. At disclosure, the package had been downloaded more than 437,000 times, and Cloudflare, Auth0 and Hugging Face documentation recommended it for connecting clients to remote servers.
Do you really need to act?#
Exploitation requires the victim's client to connect to a server the attacker controls. That can happen through a malicious or hijacked MCP server, or through a man-in-the-middle on a plain-HTTP connection. The user does have to add the server to their config, but people often add community MCP server URLs with little scrutiny. Windows users faced the worst case. No in-the-wild exploitation has been reported, and the CVE is not in CISA KEV.
As of October 2026, the main residual risk is version pinning. Many configs launch the proxy with npx mcp-remote@0.1.x or similar, and npx reuses cached copies. Machines set up in early 2025 may never have picked up the fix. The check takes five minutes, so it is worth doing.
What to do now#
- Find every use: search
claude_desktop_config.json,.cursor/mcp.jsonand other MCP configs formcp-remote. - Replace pinned versions below 0.1.16 with a current version, for example
npx -y mcp-remote@latest https://.... - Remove stale cached copies (
npm cache clean --force, or delete the_npxfolder in the npm cache) and any global install below 0.1.16 (npm ls -g mcp-remote). - Use only MCP servers you trust, and only over HTTPS, as both JFrog and The Hacker News advise.
- If an old version on Windows ever connected to a server you don't fully trust, investigate that host.
How to tell if you were hit#
No public indicators of compromise have been published. A successful exploit happens during the OAuth step, the moment you first connect to a server. On Windows, look in EDR telemetry for powershell.exe launched by node.exe with unusual arguments at the time an MCP client started a new remote connection. On macOS and Linux, look for unexpected executables launched by node. Also check MCP client logs for remote server URLs you don't recognize.
Timeline#
- — mcp-remote 0.1.16 released with the fix (per The Hacker News).
- — JFrog publishes its research and advisory; CVE-2025-6514 published.
- — Broad press coverage, citing more than 437,000 downloads.
Vulnerability records
- CVE-2025-6514 · mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL
Sources
Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.
Original and primary sources
- JFrog — Critical RCE Vulnerability in mcp-remote: CVE-2025-6514 Threatens LLM Clients jfrog.com
- JFrog Security Research — JFSA-2025-001290844: mcp-remote command injection research.jfrog.com
- CVE Program — CVE-2025-6514 record (JSON) cveawg.mitre.org
- GitHub — mcp-remote fix commit 607b226 github.com