How MCP Servers Can Expose Enterprise Secrets
A popular open-source tool called mcp-remote, which connects AI assistants like Claude Desktop to remote MCP servers, had a flaw that let a malicious server run commands on the user's computer. Anyone who pointed mcp-remote at an untrusted or hijacked server could have their machine hijacked, no extra clicks needed beyond the normal connection setup.
- Report priority
- Medium
- Targets
- MCP clients
How it works
- When mcp-remote connects to a server, the server sends back a login web address for the user's browser to open.
- A malicious server can swap that address for a rigged value that tricks mcp-remote into launching a program instead of opening a normal page.
What to do
Run npm ls mcp-remote in your project to see the installed version, and compare it against older versions as the affected range.
Run this in the application environment you want to check:
npm ls mcp-remoteUpdate mcp-remote to the latest version with npm install mcp-remote@latest, and only connect it to MCP servers you trust over HTTPS.
Technical details
Affected software: MCP clients
A researcher at JFrog sets up a rogue MCP server and has an AI client connect to it through mcp-remote. Instead of a real login link, the server answers with a rigged value pointing at the Windows calculator program. mcp-remote passes that value along without checking it, and the calculator launches automatically, proving an attacker could run any command in its place.
CVE-2025-6514 (outdated CVSS versions) is an OS command injection in mcp-remote, the proxy that bridges local STDIO-based MCP clients to remote HTTP/SSE MCP servers. During OAuth discovery, mcp-remote trusts the authorization_endpoint value returned by the server's metadata and passes it to a function that opens it in the local browser. A malicious server can set that value to a file: URI pointing at an executable, causing mcp-remote to launch it.
On Windows this yields arbitrary shell command execution with full parameter control; on macOS and Linux it launches arbitrary executables with limited parameter control. Fixed in mcp-remote 0.1.16.