Skip to content
OpenAdvisories

Package · npm

mcp-remote

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.6
    CVE-2025-6514 Public exploit EPSS 77%

    OS command injection in mcp-remote when connecting to untrusted MCP servers

    mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL

    mcp-remote npm