Cybersecurity researchers have found a important vulnerability within the open-source mcp-remote venture that might end result within the execution of arbitrary working system (OS) instructions.
The vulnerability, tracked as CVE-2025-6514, carries a CVSS rating of 9.6 out of 10.0.
“The vulnerability permits attackers to set off arbitrary OS command execution on the machine operating mcp-remote when it initiates a connection to an untrusted MCP server, posing a major danger to customers – a full system compromise,” Or Peles, JFrog Vulnerability Analysis Crew Chief, stated.
Mcp-remote is a software that sprang forth following Anthropic’s launch of Mannequin Context Protocol (MCP), an open-source framework that standardizes the best way giant language mannequin (LLM) purposes combine and share knowledge with exterior knowledge sources and providers.
It acts as a neighborhood proxy, enabling MCP shoppers like Claude Desktop to speak with distant MCP servers, versus operating them regionally on the identical machine because the LLM utility. The npm package deal has been downloaded greater than 437,000 occasions thus far.
The vulnerability impacts mcp-remote variations from 0.0.5 to 0.1.15. It has been addressed in model 0.1.16 launched on June 17, 2025. Anybody utilizing mcp-remote that connects to an untrusted or insecure MCP server utilizing an affected model is in danger.
“Whereas beforehand revealed analysis has demonstrated dangers from MCP shoppers connecting to malicious MCP servers, that is the primary time that full distant code execution is achieved in a real-world situation on the consumer working system when connecting to an untrusted distant MCP server,” Peles stated.
The shortcoming has to do with how a malicious MCP server operated by a risk actor might embed a command through the preliminary communication institution and authorization section, which, when processed by mcp-remote, causes it to be executed on the underlying working system.
Whereas the problem results in arbitrary OS command execution on Home windows with full parameter management, it leads to the execution of arbitrary executables with restricted parameter management on macOS and Linux techniques.
To mitigate the danger posed by the flaw, customers are suggested to replace the library to the most recent model and solely connect with trusted MCP servers over HTTPS.
“Whereas distant MCP servers are extremely efficient instruments for increasing AI capabilities in managed environments, facilitating speedy iteration of code, and serving to guarantee extra dependable supply of software program, MCP customers must be aware of solely connecting to trusted MCP servers utilizing safe connection strategies corresponding to HTTPS,” Peles stated.
“In any other case, vulnerabilities like CVE-2025-6514 are more likely to hijack MCP shoppers within the ever-growing MCP ecosystem.”
The disclosure comes after Oligo Safety detailed a important vulnerability within the MCP Inspector software (CVE-2025-49596, CVSS rating: 9.4) that might pave the best way for distant code execution.
Earlier this month, two different high-severity safety defects have been uncovered in Anthropic’s Filesystem MCP Server, which, if efficiently exploited, might let attackers get away of the server’s sandbox, manipulate any file on the host, and obtain code execution.
The 2 flaws, per Cymulate, are listed under –
- CVE-2025-53110 (CVSS rating: 7.3) – A listing containment bypass that makes it doable to entry, learn, or write exterior of the authorized listing (e.g., “/personal/tmp/allowed_dir”) through the use of the allowed listing prefix on different directories (e.g., “/personal/tmp/allow_dir_sensitive_credentials”), thereby opening the door knowledge theft and doable privilege escalation
- CVE-2025-53109 (CVSS rating: 8.4) – A symbolic hyperlink (aka symlink) bypass stemming from poor error dealing with that can be utilized to level to any file on the file system from throughout the allowed listing, permitting an attacker to learn or alter important recordsdata (e.g., “/and so forth/sudoers”) or drop malicious code, leading to code execution by making use of Launch Brokers, cron jobs, or different persistence methods
Each shortcomings affect all Filesystem MCP Server variations previous to 0.6.3 and 2025.7.1, which embrace the related fixes.
“This vulnerability is a severe breach of the Filesystem MCP Servers safety mannequin,” safety researcher Elad Beber stated about CVE-2025-53110. “Attackers can achieve unauthorized entry by itemizing, studying or writing to directories exterior the allowed scope, probably exposing delicate recordsdata like credentials or configurations.”
“Worse, in setups the place the server runs as a privileged person, this flaw might result in privilege escalation, permitting attackers to govern important system recordsdata and achieve deeper management over the host system.”