Incident: A sign-in link that ran a command

Module 6 · Incident file · About 30 minutes

What happened

mcp-remote is a small open-source proxy. JFrog's write-up describes it as a tool that "enables Large Language Model (LLM) hosts such as Claude Desktop to communicate with remote MCP servers, even if natively they only support communicating with local MCP servers": the host starts it over stdio with nothing but a server URL, and it speaks HTTP to that server, sign-in included.

On 9 July 2025 Or Peles of JFrog Security Research published "Critical RCE Vulnerability in mcp-remote: CVE-2025-6514 Threatens LLM Clients" (JFrog). The flaw, rated CVSS 9.6, "allows attackers to trigger arbitrary OS command execution on the machine running mcp-remote when it initiates a connection to an untrusted MCP server". It affected versions 0.0.5 to 0.1.15 and is "fixed since version 0.1.16". On Windows JFrog proved "arbitrary OS command execution (shell commands with full parameter control)"; on macOS and Linux, "execution of arbitrary executables with limited parameter control". Their claim for its weight: "this is the first time that full remote code execution is achieved in a real-world scenario on the client operating system when connecting to an untrusted remote MCP server".

The post names two ways in: the user connects to a hijacked or malicious server, or connects over plain http while an attacker on the local network takes over the traffic. The registry dates fill in the rest: 0.0.5 was published on 24 March 2025 and 0.1.16 on 17 June 2025 (npm registry), and the National Vulnerability Database published the record on 9 July 2025, the day of the write-up, classed as CWE-78, OS command injection (NVD). JFrog thanks the maintainer, Glen Maddern, "for promptly fixing this vulnerability". The cost on record is the exposure: anyone who pointed an affected version at the wrong server handed that server a way to run programs on their machine.