mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)
mcp-remote is a client tool that connects to remote MCP servers, including untrusted ones, to fetch data or tools for AI agents. A malicious or compromised MCP server can smuggle shell commands inside an OAuth metadata field, and mcp-remote will execute them on the machine running it.
How the attack works
When mcp-remote connects to an MCP server, it retrieves OAuth metadata that includes an authorization_endpoint URL. mcp-remote inserts this URL into a shell command without sanitising it. An attacker who controls the MCP server puts shell metacharacters such as $(), backticks, semicolons, pipes, && or $IFS inside the URL. When mcp-remote processes the metadata, those characters are interpreted by the shell and run as arbitrary commands on the client host, not just as part of a URL.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 5a3c5834-be49-47fc-b46a-d00e737fd676
- Severity
- Critical
- CVEs
- CVE-2025-6514
Why it matters
An attacker who controls or spoofs an MCP server can get arbitrary command execution on any machine that connects to it with mcp-remote, giving them a foothold to steal data, credentials, or pivot further into the network.
What you can do
- →Only connect mcp-remote to MCP servers you trust and control; treat third-party or community servers as untrusted input.
- →Inspect OAuth metadata responses (especially authorization_endpoint) for shell metacharacters before allowing automated processing.
- →Run mcp-remote in a sandboxed or least-privilege environment so command execution cannot reach sensitive data or credentials.
- →Monitor outbound connections and process launches triggered by mcp-remote for unexpected shell commands.
Known benign look-alikes
- Legitimate OAuth metadata documentation describing endpoint discovery for educational purposes.
- Security tooling that parses authorization_endpoint for vulnerability scanning.