Cybersecurity researchers have found a important vulnerability within the open-source mcp-remote undertaking that might consequence within the execution of arbitrary working system (OS) instructions.
The vulnerability, tracked as CVE-2025-6514, carries a CVSS rating of 9.6 out of 10.0.
“The vulnerability permits attackers to set off arbitrary OS command execution on the machine operating mcp-remote when it initiates a connection to an untrusted MCP server, posing a big danger to customers – a full system compromise,” Or Peles, JFrog Vulnerability Analysis Staff Chief, mentioned.
Mcp-remote is a software that sprang forth following Anthropic’s launch of Mannequin Context Protocol (MCP), an open-source framework that standardizes the best way giant language mannequin (LLM) purposes combine and share knowledge with exterior knowledge sources and providers.
It acts as a neighborhood proxy, enabling MCP shoppers like Claude Desktop to speak with distant MCP servers, versus operating them regionally on the identical machine because the LLM software. The npm bundle has been downloaded greater than 437,000 occasions to this point.
The vulnerability impacts mcp-remote variations from 0.0.5 to 0.1.15. It has been addressed in model 0.1.16 launched on June 17, 2025. Anybody utilizing mcp-remote that connects to an untrusted or insecure MCP server utilizing an affected model is in danger.
“Whereas beforehand printed analysis has demonstrated dangers from MCP shoppers connecting to malicious MCP servers, that is the primary time that full distant code execution is achieved in a real-world situation on the consumer working system when connecting to an untrusted distant MCP server,” Peles mentioned.
The shortcoming has to do with how a malicious MCP server operated by a risk actor might embed a command throughout the preliminary communication institution and authorization section, which, when processed by mcp-remote, causes it to be executed on the underlying working system.
Whereas the problem results in arbitrary OS command execution on Home windows with full parameter management, it ends in the execution of arbitrary executables with restricted parameter management on macOS and Linux programs.
To mitigate the chance posed by the flaw, customers are suggested to replace the library to the newest model and solely hook up with trusted MCP servers over HTTPS.
“Whereas distant MCP servers are extremely efficient instruments for increasing AI capabilities in managed environments, facilitating fast iteration of code, and serving to guarantee extra dependable supply of software program, MCP customers must be conscious of solely connecting to trusted MCP servers utilizing safe connection strategies corresponding to HTTPS,” Peles mentioned.
“In any other case, vulnerabilities like CVE-2025-6514 are more likely to hijack MCP shoppers within the ever-growing MCP ecosystem.”
The disclosure comes after Oligo Safety detailed a important vulnerability within the MCP Inspector software (CVE-2025-49596, CVSS rating: 9.4) that might pave the best way for distant code execution.
Earlier this month, two different high-severity security defects have been uncovered in Anthropic’s Filesystem MCP Server, which, if efficiently exploited, might let attackers get away of the server’s sandbox, manipulate any file on the host, and obtain code execution.
The 2 flaws, per Cymulate, are listed beneath –
- CVE-2025-53110 (CVSS rating: 7.3) – A listing containment bypass that makes it potential to entry, learn, or write outdoors of the authorised listing (e.g., “/personal/tmp/allowed_dir”) by utilizing the allowed listing prefix on different directories (e.g., “/personal/tmp/allow_dir_sensitive_credentials”), thereby opening the door knowledge theft and potential privilege escalation
- CVE-2025-53109 (CVSS rating: 8.4) – A symbolic hyperlink (aka symlink) bypass stemming from poor error dealing with that can be utilized to level to any file on the file system from inside the allowed listing, permitting an attacker to learn or alter important recordsdata (e.g., “/and so on/sudoers”) or drop malicious code, leading to code execution by making use of Launch Brokers, cron jobs, or different persistence methods
Each shortcomings affect all Filesystem MCP Server variations previous to 0.6.3 and 2025.7.1, which embody the related fixes.
“This vulnerability is a severe breach of the Filesystem MCP Servers security mannequin,” security researcher Elad Beber mentioned about CVE-2025-53110. “Attackers can acquire unauthorized entry by itemizing, studying or writing to directories outdoors the allowed scope, probably exposing delicate recordsdata like credentials or configurations.”
“Worse, in setups the place the server runs as a privileged person, this flaw might result in privilege escalation, permitting attackers to govern important system recordsdata and acquire deeper management over the host system.”
