1.
JFrog discloses CVE-2025-6514 (CVSS 9.6) in mcp-remote 0.0.5-0.1.15: connecting to untrusted MCP servers lets attackers run OS commands — the first real-world RCE via MCP clients; fixed in 0.1.16.
Skip to content
Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2025-6514.