JFrog Security Research Team Discovers Critical Remote Code Execution Vulnerability Hijacking mcp-Remote Clients
New Discovery Represents First Full Remote Code Execution (RCE) on Large Language Model (LLM) Client Machines Connecting to Untrusted MCP servers
The JFrog Security Research team has announced its discovery of a critical vulnerability in an mcp-remote server capable of performing remote code execution. The vulnerability, CVE-2025-6514 (CVSS 9.6 score), is capable of triggering arbitrary OS command execution when Model Context Protocol (MCP) clients, such as Claude Desktop, connect to an untrusted MCP server through mcp-remote. A successful attack results in the most severe consequence for the victim: complete system compromise.
“While remote MCP servers are highly effective tools for expanding AI [Artificial Intelligence] capabilities in managed environments, facilitating rapid iteration of code, and helping ensure more reliable delivery of software, MCP users need to be mindful when using them,” said Or Peles, JFrog Senior Security Researcher and Lead on the study. “It’s important that users connect to trusted MCP clients using secure connection methods such as HTTPS. Otherwise, vulnerabilities like CVE-2025-6514 could hijack MCP clients to varying degrees of impact.”
The mcp-remote tool gained popularity in the AI community when remote MCP server implementations began to emerge, enabling LLM models to interact with external data and tools. While most MCP clients still only supported connecting to local servers, this tool enabled applications that previously only supported local MCP transport via STDIO, such as Claude Desktop, Cursor, and Windsurf, to connect with remote MCP servers via HTTP transport by serving as a proxy.
The CVE-2025-6514 (CVSS 9.6 score) vulnerability affects versions 0.0.5 to 0.1.15 of mcp-remote and has been fixed in version 0.1.16. The JFrog Security Research Team strongly advises users of this function to:
- Upgrade to mcp-remote version 0.1.16 or above immediately
- Avoid connecting to untrusted or insecure MCP servers
- Always use HTTPS or other secure protocols for remote MCP transport
For more information and technical details, visit:
https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability.
