CVE-2025-6514: mcp-remote OS Command Injection Vulnerability
Summary
CVE-2025-6514: mcp-remote exposed to OS command injection via untrusted MCP server connections. Affects mcp-remote versions >= 0.0.5, < 0.1.16. Fixed in 0.1.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mcp-remote is an npm package designed for remote communication with MCP servers. It facilitates the interaction between client applications and MCP services, providing essential functionalities for data exchange. However, due to its reliance on external input from untrusted sources, it is vulnerable to OS command injection, which can lead to severe security breaches.
Vulnerability Detail
The vulnerability arises from the way mcp-remote handles input from the authorization_endpoint response URL when connecting to untrusted MCP servers. Maliciously crafted input can exploit this flaw, allowing attackers to execute arbitrary OS commands on the host system. This poses a critical risk, as it can lead to unauthorized access, data breaches, and system compromise. The vulnerability is classified under CWE-78, indicating its nature as an OS command injection issue.
How To Fix
Latest published version: 0.15.2 as of 22 Oct 2026
npm install mcp-remote@0.15.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.1.16
This is the first release that contains the fix.
npm install mcp-remote@0.1.16Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid connecting to untrusted MCP servers until the package is updated. Additionally, validate and sanitize any input received from external sources to minimize the risk of command injection.
Conclusion
The mcp-remote package is vulnerable to OS command injection due to improper handling of input from untrusted sources. It is crucial to update to the latest version to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for mcp-remote →
FAQ
CVE-2025-6514 is a critical vulnerability in the mcp-remote npm package that allows OS command injection through untrusted MCP server connections.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized OS command execution, data breaches, and complete system compromise.
Run the command 'npm install mcp-remote@0.1.16' in your terminal to update to the patched version.
The CVSS score of this vulnerability is 9.6, indicating a critical level of severity.
