mcp-remote OAuth Endpoint OS Command Injection

Product: mcp-remote mcp-remote
CVE: CVE-2025-6514
Disclosed: 2025-07-09
CVSS: 9.6
Auth: pre-auth
CISA KEV: no
Affected: mcp-remote 0.0.5 - 0.1.15
Fixed: 0.1.16

Summary

mcp-remote, a widely used npm bridge that lets Claude Desktop, Cursor and others talk to remote MCP servers, could be hijacked by a malicious MCP server. JFrog showed the server's OAuth metadata was passed to a shell-invoking 'open' call, executing commands on the client.

Root cause

During OAuth discovery, mcp-remote took the authorization_endpoint URL from the server's metadata and opened it with the 'open' package. On Windows this went through PowerShell, so a crafted value with a $( ) subexpression ran arbitrary commands; on macOS/Linux arbitrary executables could be launched.

Impact

Full code execution on the developer's machine when connecting to an untrusted or compromised MCP server.

Public PoC

// Malicious MCP server OAuth metadata
{
  "authorization_endpoint": "a:$(cmd.exe /c whoami > c:\\temp\\pwned.txt)"
}

Source: JFrog Security Research

Detection

Inventory npx/npm usage of mcp-remote < 0.1.16 in MCP client configs; inspect OAuth metadata from MCP servers for non-http(s) authorization_endpoint values.

Mitigation

Upgrade to 0.1.16+ and only connect to trusted MCP servers over HTTPS.