Critical remote code execution flaw in mcp-remote exposes AI Systems to compromise

JFrog Security Research is reporting a critical  vulnerability in the widely-used mcp-remote project that enables attackers to run operating system commands on machines running the affected software. 

The mcp-remote project is a proxy that enables Large Language Model (LLM) hosts such as Claude Desktop to communicate with remote MCP servers, even when these hosts natively only support local MCP server connections. The npm package has been downloaded more than 437,000 times to date.

This vulnerability is tracked as CVE-2025-6514 (CVSS score 9.6) and is caused by insufficient input validation during the OAuth authentication process in mcp-remote. It allows manipulation of the authorization_endpoint response URL during the OAuth authentication process. The mcp-remote will try to open this crafted URL in a browser, which, due to CVE-2025-6514, will cause a command injection, allowing the attacker to achieve arbitrary OS command execution 

The vulnerability can be triggered by a malicious MCP server that provides the following authorization_endpoint JSON

{
  "authorization_endpoint": "file:/c:/windows/system32/cmd.exe"
}

The file:// protocol handler combined with the path to an executable causes the system to launch the specified program. In this example, calc.exe (Windows Calculator) is executed as proof of concept. An attacker could replace this with any executable path, including:

• cmd.exe for command shell access
• powershell.exe for PowerShell execution
• Malicious executables dropped by previous attacks

It's the first documented case of remote code execution through a Model Context Protocol (MCP) client in real-world scenarios.

The vulnerability affects mcp-remote versions 0.0.5 through 0.1.15. 

The patched version of mcp-remote is 0.1.16. The impact varies by operating system, with Windows systems facing the highest risk of full shell command execution. macOS and Linux systems can be affected by a more limited but still dangerous executable launches.

Or Peles, Vulnerability Research Team Leader at JFrog noted "MCP users need to be mindful of only connecting to trusted MCP servers using secure connection methods such as HTTPS. Otherwise, vulnerabilities like CVE-2025-6514 are likely to hijack MCP clients in the ever-growing MCP ecosystem." 

Organizations should immediately update mcp-remote to version 0.1.16. Also, make sure to only connect to trusted MCP Servers, using HTTPS.