Critical Vulnerability Discovered in mcp-remote Project
Cybersecurity experts have recently identified a serious vulnerability in the open-source project mcp-remote, which poses a significant risk by allowing for the execution of arbitrary operating system (OS) commands. This vulnerability has been assigned the identifier CVE-2025-6514 and has received a CVSS score of 9.6 out of 10.0, indicating its critical nature.
What is mcp-remote?
The mcp-remote tool emerged in response to Anthropic’s introduction of the Model Context Protocol (MCP). This open-source framework standardizes how applications utilizing large language models (LLMs) manage and share information with various data sources and services. Essentially, mcp-remote serves as a local proxy that enables clients—such as Claude Desktop—to interact with remote MCP servers instead of running everything on the same machine as the LLM application. This npm package has become quite popular, with over 437,000 downloads to date.
Details of the Vulnerability
Versions of mcp-remote ranging from 0.0.5 to 0.1.15 are vulnerable, but this issue has been rectified in version 0.1.16, released on June 17, 2025. If you’re using an affected version and connecting to an untrusted or insecure MCP server, your system could be at serious risk. The vulnerability allows attackers to execute arbitrary OS commands on the host machine just by establishing a connection with an untrusted MCP server.
Or Peles, the Team Leader for JFrog’s Vulnerability Research, elaborated on the vulnerability, saying, "This flaw allows malicious actors to embed commands during the connection and authorization phase, which mcp-remote processes, leading to execution on the underlying OS."
Implications for Different Operating Systems
While the issues related to this vulnerability are most detrimental for Windows systems, where full parameter control is compromised, macOS and Linux face their own unique challenges. On these operating systems, the vulnerability allows for executing arbitrary executables but with limited parameter control.
Mitigating Risks
To ensure safety against this vulnerability, users should update to the latest library version immediately. Connecting only to trusted MCP servers over HTTPS is critical. Peles emphasized the balance between utility and security, stating, "Although remote MCP servers provide significant advantages in managing AI capabilities, users must remain vigilant about the servers they connect to."
Recent Vulnerabilities in the MCP Ecosystem
The disclosure of CVE-2025-6514 follows reports from Oligo Security detailing another critical vulnerability in the MCP Inspector tool (CVE-2025-49596, CVSS score: 9.4) that could potentially allow for remote code execution. Additionally, just this month, two severe security flaws were identified in Anthropic’s Filesystem MCP Server. Exploiting these vulnerabilities could enable attackers to escape the server’s sandbox environment, manipulate files, and achieve code execution.
Specific Flaws in the Filesystem MCP Server
-
CVE-2025-53110 (CVSS score: 7.3) – This vulnerability involves a directory containment bypass. It allows unauthorized access to read or write outside approved directories, which enhances the potential for data theft and privilege escalation.
- CVE-2025-53109 (CVSS score: 8.4) – This flaw arises from poor error handling concerning symbolic links, enabling attackers to point to files outside of the allowed directory. This access could lead to altering critical system files or deploying malicious code, potentially resulting in persistent threats through methods like Launch Agents or cron jobs.
Impact and Recommendations
Both of these vulnerabilities affect all Filesystem MCP Server versions prior to 0.6.3 and 2025.7.1, which include fixes for these concerns. Security researchers highlight the serious implications of these vulnerabilities, particularly when the server operates with elevated privileges, increasing the potential for attackers to gain control over sensitive system files.
As threats in the MCP environment continue to evolve, staying informed and proactive in addressing vulnerabilities remains essential for safeguarding sensitive data and maintaining system integrity.
