CVE-2025-6514
OS command injection in mcp-remote when connecting to untrusted MCP servers
Résumé
OS command injection in mcp-remote when connecting to untrusted MCP servers
Description d'origine
La description telle que publiée par la source (souvent en anglais).
mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory research.jfrog.com
- patch github.com
- web registry.npmjs.org
- web jfrog.com