GHSA-6xpm-ggf7-wc3p: mcp-remote exposed to OS command injection via untrusted MCP server connections
GHSA-6xpm-ggf7-wc3p · CVE-2025-6514
- Advisory ID
- DURIN-MCP-2026-000011
- Severity
- critical
- Publication state
- published
- Updated
Summary
mcp-remote exposed to OS command injection via untrusted MCP server connections
This is a public advisory summary. Its publication state does not establish whether a particular deployed connection is affected or has been remediated.
Complete the browser check below for affected versions, remediation, revision history and attributed assessment evidence.