Critical RCE Vulnerability in mcp-remote: CVE-2025-6514 Threatens LLM Clients

CVE

CVE-2025-6514

Published

2025-07-09 13:00

Collected

2026-08-22 00:56

---
id: 6708
title: "Critical RCE Vulnerability in mcp-remote: CVE-2025-6514 Threatens LLM Clients"
cve: CVE-2025-6514
source_domain: jfrog.com
source_url: "https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability/"
published_at: "2025-07-09T13:00:08Z"
tags: ["ai-security", "rce", "mcp", "jfrog", "cve-2025-6514", "mcp-remote"]
phying_url: "https://phying.com/item/6708"
lang: en
---

# Critical RCE Vulnerability in mcp-remote: CVE-2025-6514 Threatens LLM Clients

## Summary

JFrog discloses CVE-2025-6514 (CVSS 9.6) in mcp-remote 0.0.5-0.1.15: connecting to untrusted MCP servers lets attackers run OS commands — the first real-world RCE via MCP clients; fixed in 0.1.16.

## Intelligence Metadata

- **Sources:** jfrog.com
- **CVE:** CVE-2025-6514
- **Published:** 2025-07-09T13:00:08Z
- **Original:** https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability/
- **Phying News:** https://phying.com/item/6708