Cybersecurity researchers have found a important vulnerability within the open-source mcp-remote mission that would end result within the execution of arbitrary working system (OS) instructions.
The vulnerability, tracked as CVE-2025-6514, carries a CVSS rating of 9.6 out of 10.0.
“The vulnerability permits attackers to set off arbitrary OS command execution on the machine operating mcp-remote when it initiates a connection to an untrusted MCP server, posing a major threat to customers – a full system compromise,” Or Peles, JFrog Vulnerability Analysis Crew Chief, mentioned.
Mcp-remote is a instrument that sprang forth following Anthropic’s launch of Mannequin Context Protocol (MCP), an open-source framework that standardizes the way in which massive language mannequin (LLM) purposes combine and share knowledge with exterior knowledge sources and providers.
It acts as an area proxy, enabling MCP shoppers like Claude Desktop to talk with distant MCP servers, versus operating them domestically on the identical machine because the LLM utility. The npm package deal has been downloaded greater than 437,000 occasions up to now.
The vulnerability impacts mcp-remote variations from 0.0.5 to 0.1.15. It has been addressed in model 0.1.16 launched on June 17, 2025. Anybody utilizing mcp-remote that connects to an untrusted or insecure MCP server utilizing an affected model is in danger.
“Whereas beforehand revealed analysis has demonstrated dangers from MCP shoppers connecting to malicious MCP servers, that is the primary time that full distant code execution is achieved in a real-world situation on the consumer working system when connecting to an untrusted distant MCP server,” Peles mentioned.
The shortcoming has to do with how a malicious MCP server operated by a risk actor may embed a command through the preliminary communication institution and authorization section, which, when processed by mcp-remote, causes it to be executed on the underlying working system.
Whereas the problem results in arbitrary OS command execution on Home windows with full parameter management, it ends in the execution of arbitrary executables with restricted parameter management on macOS and Linux methods.
To mitigate the danger posed by the flaw, customers are suggested to replace the library to the newest model and solely hook up with trusted MCP servers over HTTPS.
“Whereas distant MCP servers are extremely efficient instruments for increasing AI capabilities in managed environments, facilitating speedy iteration of code, and serving to guarantee extra dependable supply of software program, MCP customers have to be conscious of solely connecting to trusted MCP servers utilizing safe connection strategies similar to HTTPS,” Peles mentioned.
“In any other case, vulnerabilities like CVE-2025-6514 are more likely to hijack MCP shoppers within the ever-growing MCP ecosystem.”
The disclosure comes after Oligo Safety detailed a important vulnerability within the MCP Inspector instrument (CVE-2025-49596, CVSS rating: 9.4) that would pave the way in which for distant code execution.
Earlier this month, two different high-severity safety defects had been uncovered in Anthropic’s Filesystem MCP Server, which, if efficiently exploited, may let attackers get away of the server’s sandbox, manipulate any file on the host, and obtain code execution.
The 2 flaws, per Cymulate, are listed under –
- CVE-2025-53110 (CVSS rating: 7.3) – A listing containment bypass that makes it potential to entry, learn, or write outdoors of the accepted listing (e.g., “/personal/tmp/allowed_dir”) through the use of the allowed listing prefix on different directories (e.g., “/personal/tmp/allow_dir_sensitive_credentials”), thereby opening the door knowledge theft and potential privilege escalation
- CVE-2025-53109 (CVSS rating: 8.4) – A symbolic hyperlink (aka symlink) bypass stemming from poor error dealing with that can be utilized to level to any file on the file system from throughout the allowed listing, permitting an attacker to learn or alter important information (e.g., “/and many others/sudoers”) or drop malicious code, leading to code execution by making use of Launch Brokers, cron jobs, or different persistence methods
Each shortcomings affect all Filesystem MCP Server variations previous to 0.6.3 and 2025.7.1, which embody the related fixes.
“This vulnerability is a critical breach of the Filesystem MCP Servers safety mannequin,” safety researcher Elad Beber mentioned about CVE-2025-53110. “Attackers can acquire unauthorized entry by itemizing, studying or writing to directories outdoors the allowed scope, probably exposing delicate information like credentials or configurations.”
“Worse, in setups the place the server runs as a privileged person, this flaw may result in privilege escalation, permitting attackers to control important system information and acquire deeper management over the host system.”
