mcp-remote exposed to OS command injection from untrusted MCP servers, per GitHub advisory

Summary

GitHub advisory GHSA-6xpm-ggf7-wc3p (CVE-2025-6514, critical): mcp-remote versions from 0.0.5 up to but not including 0.1.16 are exposed to OS command injection when connecting to untrusted MCP servers, through a crafted authorization_endpoint response URL.

Techniques

Technique-level mapping, an editorial judgment made by the method.

• T1059 Command and Scripting Interpreter

MITRE ATT&CK technique IDs and names: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

Not mapped. AI RMF mapping is optional for cyber incidents.

NIST SP 800-53

• SI-10 Information Input Validation
• CM-7 Least Functionality
• SC-7 Boundary Protection
• SI-2 Flaw Remediation

Human-approval (JCR) checkpoint

not applicable

Correlated incidents

Co-occurrence, not cause: each link records something the two incidents share, as its rationale and source state. It does not say one incident caused the other. Links are written on one record; the other record shows the same link marked derived.

• AI AIA-013 Cursor agent: writing MCP config files without approval enabled code execution (CVE-2025-54135), per Cursor advisory

  same technique

  Both involve MCP tooling leading to command execution: a crafted authorization_endpoint from an untrusted MCP server could inject OS commands into mcp-remote, and Cursor's advisory describes agent-written MCP config files that enabled code execution.

  Source: github.com https://github.com/cursor/cursor/security/advisories/GHSA-4cxx-hrm3-49rm

• Cyber CYB-007 MCP Inspector below 0.14.1 allowed unauthenticated remote code execution, per GitHub advisory

  same technique

  Both are MCP tooling flaws leading to command execution, per their GitHub advisories: missing authentication between the MCP Inspector client and proxy, and OS command injection in mcp-remote.

  Source: github.com https://github.com/advisories/GHSA-7f8r-222p-6f5g

Sources

• github.com primary link checked 2026-10-31, HTTP 200
  GHSA-6xpm-ggf7-wc3p; published Jul 9, 2025; rated critical
  https://github.com/advisories/GHSA-6xpm-ggf7-wc3p

Corrections

No corrections recorded.

To report an error in this entry, see corrections.