---
title: "mcp-remote: OS Command Injection via OAuth Endpoint"
url: https://erroneo.us/security/briefs/mcp-remote-oauth-command-injection/
description: "mcp-remote 0.0.5-0.1.15 runs attacker commands when it connects to a malicious MCP server (CVE-2025-6514, CVSS 9.6). Fixed in 0.1.16. Check pinned configs."
type: security-brief
section: "Security Digest"
date_published: 2025-07-09
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-6514"]
severity: "critical"
exploited: "public-poc"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# mcp-remote: OS Command Injection via OAuth Endpoint

**Verdict: Check exposure.** The fix is more than a year old, but version-pinned MCP client configs and stale npx caches can keep a vulnerable mcp-remote alive, so confirm the version and move on.

- **Who must act:** Anyone whose Claude Desktop, Cursor, Windsurf or other MCP client config launches mcp-remote at a version below 0.1.16, especially on Windows.
- **Who can relax:** Users who run mcp-remote 0.1.16 or later, or who don't use mcp-remote at all.
- **Affected:** mcp-remote 0.0.5 through 0.1.15
- **Fixed:** mcp-remote 0.1.16
- **CVEs:** CVE-2025-6514
- **CISA KEV:** no · **Exploitation:** Public proof-of-concept

## What to do

1. Grep MCP client configs (claude_desktop_config.json, .cursor/mcp.json, etc.) for `mcp-remote` and note any pinned version.
2. Change pins to `mcp-remote@latest` or an explicit version at or above 0.1.16.
3. Clear stale npx copies (`npm cache clean --force`, or delete the `_npx` directory under the npm cache) so an old cached build isn't reused.
4. Connect only to MCP servers you trust, and only over HTTPS.
5. On Windows, treat any previous connection to an unknown MCP server through an old mcp-remote as a possible compromise.

### How to check if you are affected

- Run `npm ls -g mcp-remote` and search the npm `_npx` cache for mcp-remote package.json files with versions below 0.1.16.
- Review MCP client logs for OAuth discovery against unfamiliar server URLs.
- On Windows, hunt for PowerShell processes spawned by node.exe with unusual arguments around the time an MCP connection was made.

## What happened

On July 9, 2025, JFrog Security Research disclosed [CVE-2025-6514](https://cveawg.mitre.org/api/cve/CVE-2025-6514), an OS command injection in `mcp-remote`. The npm package is a proxy that lets MCP hosts such as Claude Desktop, which mostly speak local stdio, connect to remote MCP servers over HTTP, and it also handles OAuth for them. The CNA (JFrog) scored it CVSS 3.1 9.6.

The bug sits in the OAuth flow. As [JFrog's write-up](https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability/) explains, the remote server answers the first request with a 401, and mcp-remote fetches the server's OAuth metadata. A malicious server can return a crafted `authorization_endpoint`. mcp-remote passes that value to the `open` npm package to launch a browser. On Windows, `open` goes through PowerShell, where the crafted value turns into arbitrary command execution with full control of the arguments. On macOS and Linux, JFrog showed that an attacker could launch arbitrary executables with only limited control over arguments, and said full command execution "may be achievable." JFrog's [advisory page](https://research.jfrog.com/vulnerabilities/mcp-remote-command-injection-rce-jfsa-2025-001290844/) includes a proof of concept that uses a `file:` URL to run a local program.

## Who is affected

mcp-remote versions 0.0.5 through 0.1.15. The fix arrived in 0.1.16, which [The Hacker News](https://thehackernews.com/2025/07/critical-mcp-remote-vulnerability.html) reports was released on June 17, 2025, three weeks before public disclosure. The [referenced fix commit](https://github.com/geelen/mcp-remote/commit/607b226a356cb61a239ffaba2fb3db1c9dea4bac) URL-encodes user and password components in the sanitized URL. At disclosure, the package had been downloaded more than 437,000 times, and Cloudflare, Auth0 and Hugging Face documentation recommended it for connecting clients to remote servers.

## Do you really need to act?

Exploitation requires the victim's client to connect to a server the attacker controls. That can happen through a malicious or hijacked MCP server, or through a man-in-the-middle on a plain-HTTP connection. The user does have to add the server to their config, but people often add community MCP server URLs with little scrutiny. Windows users faced the worst case. No in-the-wild exploitation has been reported, and the CVE is not in CISA KEV.

As of October 2026, the main residual risk is version pinning. Many configs launch the proxy with `npx mcp-remote@0.1.x` or similar, and npx reuses cached copies. Machines set up in early 2025 may never have picked up the fix. The check takes five minutes, so it is worth doing.

## What to do now

1. Find every use: search `claude_desktop_config.json`, `.cursor/mcp.json` and other MCP configs for `mcp-remote`.
2. Replace pinned versions below 0.1.16 with a current version, for example `npx -y mcp-remote@latest https://...`.
3. Remove stale cached copies (`npm cache clean --force`, or delete the `_npx` folder in the npm cache) and any global install below 0.1.16 (`npm ls -g mcp-remote`).
4. Use only MCP servers you trust, and only over HTTPS, as both JFrog and The Hacker News advise.
5. If an old version on Windows ever connected to a server you don't fully trust, investigate that host.

## How to tell if you were hit

No public indicators of compromise have been published. A successful exploit happens during the OAuth step, the moment you first connect to a server. On Windows, look in EDR telemetry for `powershell.exe` launched by `node.exe` with unusual arguments at the time an MCP client started a new remote connection. On macOS and Linux, look for unexpected executables launched by node. Also check MCP client logs for remote server URLs you don't recognize.

## Timeline

- Jun 17, 2025 — mcp-remote 0.1.16 released with the fix (per The Hacker News).
- Jul 9, 2025 — JFrog publishes its research and advisory; CVE-2025-6514 published.
- Jul 10, 2025 — Broad press coverage, citing more than 437,000 downloads.

## Sources

1. [JFrog — Critical RCE Vulnerability in mcp-remote: CVE-2025-6514 Threatens LLM Clients](https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability/)
2. [JFrog Security Research — JFSA-2025-001290844: mcp-remote command injection](https://research.jfrog.com/vulnerabilities/mcp-remote-command-injection-rce-jfsa-2025-001290844/)
3. [CVE Program — CVE-2025-6514 record (JSON)](https://cveawg.mitre.org/api/cve/CVE-2025-6514)
4. [GitHub — mcp-remote fix commit 607b226](https://github.com/geelen/mcp-remote/commit/607b226a356cb61a239ffaba2fb3db1c9dea4bac)
5. [The Hacker News — Critical mcp-remote Vulnerability Enables Remote Code Execution](https://thehackernews.com/2025/07/critical-mcp-remote-vulnerability.html)

---
Source page: https://erroneo.us/security/briefs/mcp-remote-oauth-command-injection/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt