Loading vulnerability…
CVE-2025-6514 is an OS command-injection vulnerability in mcp-remote versions 0.0.5 through 0.1.15, a local proxy that connects MCP clients to remote MCP servers. During connection establishment and authorization, an untrusted server can supply a crafted authorization_endpoint URL that reaches operating-system command execution without adequate sanitization. On Windows, exploitation permits arbitrary OS commands with full parameter control; on macOS and Linux, it permits execution of arbitrary executables with limited parameter control. The vulnerability has a CVSS 3.1 score of 9.6.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No valid public exploits. Mallory filtered out 4 candidates as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
34 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A command-injection vulnerability in the mcp-remote proxy involving a malicious MCP server's authorization endpoint reaching the command line. It is mentioned as a historical comparison to the unnamed OpenCode vulnerability that is the article's primary subject.
A critical OS command-injection vulnerability in a widely used Model Context Protocol (MCP) bridge that can allow arbitrary command execution on a client host when it connects to an untrusted MCP server.
A remote-code-execution vulnerability in mcp-remote, cited as background evidence for risks introduced by exposing an offensive testing engine through the Model Context Protocol (MCP).
An OS command-injection vulnerability in MCP client/server interactions that can enable full remote code execution when clients connect to untrusted MCP servers.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.