CVE-2025-6514 — OS command injection in mcp-remote when connecting to untrusted MCP servers
mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL
Published: 2025-07-09 · CVSS: 9.6 · CVSS 3.1
mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7