CVE-2025-6514
OS command injection in mcp-remote when connecting to untrusted MCP servers
Summary
OS command injection in mcp-remote when connecting to untrusted MCP servers
Original description
The description as published by the source.
mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory nvd.nist.gov
- advisory research.jfrog.com
- patch github.com
- web registry.npmjs.org
- web jfrog.com