ACVE-2025-0002

The configuration

Configuration label

mcp-remote >=0.0.5 <0.1.16

Affected entries

• npm: mcp-remote — SEMVER (introduced 0; fixed 0.1.16)
• MCP: pkg:npm/mcp-remote — SEMVER (introduced 0; fixed 0.1.16)

Matcher

• some mcpServers
  • all
    • package eq "pkg:npm/mcp-remote"
    • resolvedVersion semverRange ">=0.0.5 <0.1.16"

Why it is exploitable

What the vulnerability is

mcp-remote is a proxy that lets a local MCP client connect to a remote MCP server. In versions 0.0.5 through before 0.1.16, an MCP server can return a crafted OAuth authorization URL that reaches operating-system command construction. The consequence is command execution with the privileges of the client process.

Which configuration is exposed

The exposed combination is an MCP server launched as the PURL pkg:npm/mcp-remote with a resolved version in >=0.0.5 <0.1.16, typically with a remote URL supplied as an argument. The matcher encodes both the package identity and that resolved-version range. It does not require a particular harness or transport because the vulnerable proxy can be embedded in different MCP client configurations.

How ACVE detects it

ACVE reads mcpServers[].package and mcpServers[].resolvedVersion. A server launched through npx can have an unknown resolved version, so the finding is reported as possible when the package identity is present but resolution is unavailable. ACVE also cannot determine whether the remote endpoint is trusted or whether an OAuth flow has occurred; the lockfile signal is a package-and-version exposure check, not exploit confirmation.

Fix

1. Upgrade mcp-remote to 0.1.16 or later and refresh the lockfile so the resolved version is recorded.
2. Remove or replace configurations that connect the proxy to an untrusted MCP URL until the upgrade is in place.

Do not treat an unknown resolved version as evidence of safety: the package runner may resolve a vulnerable release at runtime.

References

See references for primary sources.

Underlying CVEs / aliases

• CVE-2025-6514

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Upgrade mcp-remote to 0.1.16 or later and remove untrusted remote URLs.

Validation

Grounding

• OSV: found; aliases: CVE-2025-6514, GHSA-6xpm-ggf7-wc3p; checked-at 2026-09-20T02:43:21Z
• NVD: found; checked-at 2026-09-20T02:43:21Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:21Z

References

ADVISORY

• https://nvd.nist.gov/vuln/detail/CVE-2025-6514

REPORT

• https://example.com/research/acve

FIX

• https://github.com/pickbitsai/acve/issues?q=CVE-2025-6514