{
  "schema_version": "1.6.0",
  "id": "ACVE-2025-0002",
  "aliases": [
    "CVE-2025-6514"
  ],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-20T02:45:17.577Z",
  "summary": "mcp-remote can inject operating-system commands through an untrusted URL",
  "details": "## What the vulnerability is\n\n`mcp-remote` is a proxy that lets a local MCP client connect to a remote MCP server. In versions `0.0.5` through before `0.1.16`, an MCP server can return a crafted OAuth authorization URL that reaches operating-system command construction. The consequence is command execution with the privileges of the client process.\n\n## Which configuration is exposed\n\nThe exposed combination is an MCP server launched as the PURL `pkg:npm/mcp-remote` with a resolved version in `>=0.0.5 <0.1.16`, typically with a remote URL supplied as an argument. The matcher encodes both the package identity and that resolved-version range. It does not require a particular harness or transport because the vulnerable proxy can be embedded in different MCP client configurations.\n\n## How ACVE detects it\n\nACVE reads `mcpServers[].package` and `mcpServers[].resolvedVersion`. A server launched through `npx` can have an unknown resolved version, so the finding is reported as *possible* when the package identity is present but resolution is unavailable. ACVE also cannot determine whether the remote endpoint is trusted or whether an OAuth flow has occurred; the lockfile signal is a package-and-version exposure check, not exploit confirmation.\n\n## Fix\n\n1. Upgrade `mcp-remote` to `0.1.16` or later and refresh the lockfile so the resolved version is recorded.\n2. Remove or replace configurations that connect the proxy to an untrusted MCP URL until the upgrade is in place.\n\nDo not treat an unknown resolved version as evidence of safety: the package runner may resolve a vulnerable release at runtime.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "mcp-remote"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.16"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "MCP",
        "name": "pkg:npm/mcp-remote"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.16"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6514"
    },
    {
      "type": "REPORT",
      "url": "https://example.com/research/acve"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pickbitsai/acve/issues?q=CVE-2025-6514"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "9.5"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "published",
      "vulnClasses": [
        "command-injection"
      ],
      "cwe": [
        "CWE-78"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI02 Tool Misuse"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "matcher": {
        "some": "mcpServers",
        "where": {
          "all": [
            {
              "field": "package",
              "op": "eq",
              "value": "pkg:npm/mcp-remote"
            },
            {
              "field": "resolvedVersion",
              "op": "semverRange",
              "value": ">=0.0.5 <0.1.16"
            }
          ]
        }
      },
      "fix": {
        "summary": "Upgrade mcp-remote to 0.1.16 or later and remove untrusted remote URLs.",
        "actions": [
          {
            "type": "upgrade",
            "target": "mcp:pkg:npm/mcp-remote",
            "to": "0.1.16",
            "why": "Use the fixed release."
          }
        ]
      },
      "exposure": "local",
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:21Z",
          "found": true,
          "aliasesConfirmed": [
            "CVE-2025-6514",
            "GHSA-6xpm-ggf7-wc3p"
          ],
          "packagesConfirmed": [],
          "fixedVersionsConfirmed": [],
          "cvss": [
            {
              "type": "CVSS_V3",
              "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
            }
          ]
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:21Z",
          "found": true,
          "cvss": 9.6,
          "published": "2025-07-09T13:15:24.213"
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:21Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:21Z",
          "confirmed": [
            "npm:mcp-remote@0.1.16"
          ],
          "missing": []
        }
      },
      "validatedBy": [
        {
          "who": "Mark Pickering (PickBits) via Claude Code session 01YR6ri2tM3jU9vdQNe9R5pw",
          "date": "2026-09-20",
          "method": "vendor-advisory",
          "evidence": "https://github.com/advisories/GHSA-6xpm-ggf7-wc3p",
          "note": "mcp-remote >=0.0.5 <0.1.16 OS command injection; fix 0.1.16 per GHSA; NVD CVSS 9.6."
        }
      ]
    }
  }
}