CVE-2025-6514

What it actually does

The flaw is an OS command injection condition in mcp-remote triggered when a client connects to an untrusted MCP server and processes crafted input from the authorization_endpoint response URL. Because attacker-controlled URL data is incorporated into a command execution path without sufficient validation or escaping, shell metacharacters or command substitutions can cause arbitrary commands to run on the client system. The CVSS vector indicates network reachability, low attack complexity, no attacker authentication required, required user interaction, changed scope, and high confidentiality, integrity, and availability impact. The supplied package metadata also lists mbedtls in Alpine v3.20 and armmbed/mbedtls Git artifacts as affected, so engineering teams should verify the advisory-to-package mapping in their software composition data and prioritize any dependency instances matching the fixed versions listed.

Why it matters to the business

Successful exploitation can give an attacker code execution on a developer workstation, automation host, or service that connects to an untrusted MCP server, enabling theft of source code, credentials, API tokens, model/tool access, and lateral movement into build or production systems. Even though it is not currently listed in CISA KEV and exploit maturity is reported as none, the CVSS score is critical and EPSS is high at 0.77546, indicating meaningful likelihood of exploitation. Because it has been public for 397 days, organizations should assume attackers and security researchers have had ample time to analyze vulnerable implementations and should treat exposed usage as urgent.

How an attack unfolds

An attacker operates or compromises an MCP server that a target user or process can be induced to connect to. During the authorization flow, the malicious server returns a crafted authorization_endpoint URL containing shell metacharacters, command substitutions, or other payload content designed to escape the intended URL-handling context. A vulnerable mcp-remote client processes that response and passes the attacker-controlled value into an OS command execution sink. When the command is invoked, the injected payload executes with the privileges of the client process. From there, the attacker may download second-stage tooling, read local secrets and configuration files, steal tokens used by MCP clients or development tooling, alter project files, establish persistence, or pivot using credentials available on the compromised host.

How to fix it

Upgrade affected components to fixed versions and remove vulnerable builds from all developer, CI/CD, automation, container, and server images. For the supplied package data, Alpine v3.20 mbedtls should be updated to 3.6.4-r0 or later, and armmbed/mbedtls Git consumers should include commit c765c831e5c2a0971410692f92f7a81d6ec65ec2 or a later fixed revision. Because the vulnerability description refers to mcp-remote command injection while the affected-product metadata lists mbedtls packages, teams should validate the upstream advisory mapping against their SBOM, lockfiles, container manifests, and package manager data before closing the issue. As compensating controls, allow connections only to trusted MCP servers, block unapproved MCP server destinations with egress policy, disable or restrict automatic authorization flows where possible, run MCP clients with least privilege, isolate developer tooling from production credentials, and ensure URL values are parsed as data rather than passed through shell execution paths.

How to confirm the fix worked

Confirm remediation by inventorying installed packages, container layers, lockfiles, and source dependencies for vulnerable mcp-remote usage and for the listed mbedtls artifacts. On Alpine v3.20, verify the installed mbedtls package version is 3.6.4-r0 or later. For Git-based armmbed/mbedtls consumers, verify the checked-out revision includes c765c831e5c2a0971410692f92f7a81d6ec65ec2 or a later fixed commit. Rebuild and redeploy dependent containers and applications so patched libraries are actually in runtime images. Where safe, perform a controlled negative test against a non-production MCP server that returns authorization_endpoint values containing benign shell metacharacters and confirm they are rejected, encoded, or handled without spawning shell processes. Validate egress controls by confirming only approved MCP server endpoints are reachable from developer and automation environments.

Typical attack path

1. Identify users, developer tooling, automation jobs, or services that use mcp-remote or a vulnerable dependency path.
2. Host or compromise an MCP server that the victim can be convinced or configured to connect to.
3. Return a crafted authorization_endpoint response URL containing command injection syntax.
4. Trigger the vulnerable client-side authorization handling path when the victim initiates the connection.
5. Execute arbitrary OS commands under the privileges of the mcp-remote client process.
6. Stage follow-on commands to collect environment variables, credentials, API tokens, SSH keys, source code, and local configuration.
7. Optionally install persistence, modify project or build artifacts, or use stolen credentials for lateral movement.

How to detect it

Review endpoint telemetry, EDR process trees, shell history, proxy logs, DNS logs, MCP client logs, application logs, and authentication-flow logs for suspicious activity around mcp-remote connections. Focus on mcp-remote or related client processes that spawn unexpected child processes such as sh, bash, zsh, cmd.exe, powershell.exe, python, curl, wget, nc, ncat, socat, openssl, or certutil. Search logs for authorization_endpoint values containing shell metacharacters, command substitutions, pipes, semicolons, backticks, encoded command payloads, or download-and-execute patterns. Correlate suspicious authorization responses with outbound connections to unfamiliar MCP servers, newly contacted domains, paste sites, file-sharing hosts, raw code hosting URLs, or direct IP addresses. On affected hosts, inspect recent shell history, temporary directories, user profile startup locations, cron/systemd launch points, SSH authorized_keys changes, npm/pip/go package modifications, and recently modified project or build files. Because exploitation requires interaction with a malicious or compromised MCP server, prioritize timelines where a user or automation job connected to a new MCP server shortly before suspicious process execution or credential access.

• mcp-remote
• authorization_endpoint
• authorization_endpoint=
• "authorization_endpoint"
• ;curl
• |curl
• && curl
• `curl
• $(curl
• ;wget
• |wget
• && wget
• `wget
• $(wget
• | sh
• | bash
• ; sh
• ; bash
• cmd.exe /c
• powershell.exe -enc
• powershell -EncodedCommand
• certutil.exe -urlcache
• /bin/sh -c
• /bin/bash -c
• nc -e
• ncat -e
• socat exec:
• /tmp/
• /var/tmp/
• ~/.ssh/authorized_keys
• /etc/cron.d/
• /etc/systemd/system/

What your security team should do

• Prioritize patching despite the absence of KEV status because the issue is critical severity, remotely triggerable with user interaction, and has a high EPSS score.
• Identify all use of mcp-remote, MCP clients, MCP server integrations, Alpine v3.20 mbedtls packages, and Git-based armmbed/mbedtls dependencies across workstations, CI/CD, containers, and production-adjacent automation.
• Upgrade Alpine v3.20 mbedtls to 3.6.4-r0 or later and ensure armmbed/mbedtls consumers include commit c765c831e5c2a0971410692f92f7a81d6ec65ec2 or later where those artifacts are applicable.
• Restrict MCP client connections to explicitly approved MCP servers and block unknown MCP server destinations at DNS, proxy, or firewall layers.
• Run MCP-related tooling in sandboxed, least-privilege contexts without access to broad cloud credentials, production secrets, or sensitive source repositories.
• Hunt for evidence of mcp-remote spawning shells, script interpreters, download utilities, or network tools shortly after MCP connection or authorization activity.
• Rotate credentials and tokens present on any host where suspicious mcp-remote child processes or untrusted MCP server connections are found.
• Verify the product/package mismatch in the vulnerability metadata before suppressing findings, and document the exact advisory and package evidence used for closure.