CVE-2025-6514

CriticalRCE

Published: 09 July 2025

Published

09 July 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS Score 0.0617 90.9th percentile

Risk Priority 23 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-6514 is a critical-severity OS Command Injection (CWE-78) vulnerability in Jfrog (inferred from references). Its CVSS base score is 9.6 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 9.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

SI-10 requires validation of untrusted inputs like the crafted authorization_endpoint URL to prevent OS command injection.

SI-2 Flaw Remediation good match

prevent

SI-2 mandates timely flaw remediation, including applying the specific patch for CVE-2025-6514 to eliminate the command injection vulnerability.

AC-20 Use of External Systems partial match

prevent

AC-20 establishes conditions and approvals for using external systems, mitigating risks from connecting mcp-remote to untrusted MCP servers.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

OS command injection directly enables arbitrary command execution (T1059) on the client host after user-initiated connection to a malicious server (T1203 Exploitation for Client Execution).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL

Deeper analysisAI

CVE-2025-6514 is an OS command injection vulnerability (CWE-78) affecting the mcp-remote software component. The issue arises when mcp-remote connects to untrusted MCP servers and processes crafted input from the authorization_endpoint response URL, allowing arbitrary command execution on the host system. Published on 2025-07-09, it carries a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and high potential impact.

Attackers can exploit CVE-2025-6514 remotely without privileges by tricking users into connecting mcp-remote to a malicious MCP server they control. User interaction is required, such as initiating the connection, after which the attacker crafts the authorization_endpoint response URL to inject OS commands. Successful exploitation enables remote code execution (RCE), granting high-impact access to confidentiality, integrity, and availability, with a scope change that amplifies the effects across security boundaries.

Mitigation is addressed in a patch via the mcp-remote GitHub commit at https://github.com/geelen/mcp-remote/commit/607b226a356cb61a239ffaba2fb3db1c9dea4bac. JFrog advisories provide further details, including analysis of the command injection leading to RCE, at https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability and https://research.jfrog.com/vulnerabilities/mcp-remote-command-injection-rce-jfsa-2025-001290844/. Security practitioners should apply the patch and avoid connecting to untrusted MCP servers.