Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Critical RCE Vulnerability in mcp-remote: CVE-2025-6514 Threatens LLM Clients

jfrog.com | research | CVE-2025-6514 | #ai-security | #rce | #mcp | #jfrog | #cve-2025-6514 | #mcp-remote

Summary

JFrog discloses CVE-2025-6514 (CVSS 9.6) in mcp-remote 0.0.5-0.1.15: connecting to untrusted MCP servers lets attackers run OS commands — the first real-world RCE via MCP clients; fixed in 0.1.16.
Published
Collected

original ↗

Related coverage

  1. The Evolution of JFrog AI Catalog: Your AI Control Plane for Agentic Development (jfrog.com)
  2. Agent Immunization: A New Model for Building Trusted AI Agents (jfrog.com)
  3. Introducing JFrog’s MCP Server: Better vibes and easier AI automation (jfrog.com)
  4. James Kettle’s ‘autonomous research cascade’, CRLF-powered desync attacks, RCE on humanoid robots – ethical hacker news roundup (yeswehack.com)
  5. Google ARTEMIS: Natural-Language Driven Android Automation & Mobile AI Agent Framework (github.com)
  6. LLM SecRange: Open-Source Penetration Testing Playground for Large Language Models & Vulnerable Agents (github.com)

back