Skip to content

PatchFirst · Latest vulnerabilities

mcp-remote vulnerabilities

Vulnerabilities published for mcp-remote in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerability: 1

CVE-2025-6514
Critical · CVSS 9.6EPSS 77.03%Fix available
OS command injection in mcp-remote when connecting to untrusted MCP servers
mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL
mcp-remote Node.js
- Update to 0.1.16
Published July 9, 2025Updated July 9, 2025
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →