criticalATLS-2025-0001CVE-2025-6514

mcp-remote: OS command injection from a malicious MCP server's OAuth authorization_endpoint

Imported from public sources listed below. Verfy has not independently reproduced this issue.

Details

mcp-remote passed the authorization_endpoint URL returned by a remote MCP server during the OAuth flow to a function that opens URLs on the local machine. A malicious or compromised MCP server could craft that value so that connecting to it ran arbitrary OS commands on the developer's machine. Upgrade mcp-remote to 0.1.16 or later and only connect to MCP servers you trust.

Affected

npm mcp-remote

Versions from 0.0.5 before 0.1.16. Fixed in 0.1.16.

# check what a project uses
$ npm ls mcp-remote

References

https://nvd.nist.gov/vuln/detail/CVE-2025-6514 (ADVISORY)
https://www.wiz.io/vulnerability-database/cve/cve-2025-6514 (WEB)

Published in Verfy 2026-10-11 · modified 2026-10-11