# mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)

- **Severity:** Critical
- **Signature ID:** `5a3c5834-be49-47fc-b46a-d00e737fd676`
- **CVEs:** CVE-2025-6514
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise), AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI04 (Memory and Context Poisoning), ASI05 (Cascading Failures in Multi-Agent Systems), LLM03 (Supply Chain), LLM05 (Improper Output Handling)

## Summary

mcp-remote is a client tool that connects to remote MCP servers, including untrusted ones, to fetch data or tools for AI agents. A malicious or compromised MCP server can smuggle shell commands inside an OAuth metadata field, and mcp-remote will execute them on the machine running it.

## How the attack works

When mcp-remote connects to an MCP server, it retrieves OAuth metadata that includes an authorization_endpoint URL. mcp-remote inserts this URL into a shell command without sanitising it. An attacker who controls the MCP server puts shell metacharacters such as $(), backticks, semicolons, pipes, && or $IFS inside the URL. When mcp-remote processes the metadata, those characters are interpreted by the shell and run as arbitrary commands on the client host, not just as part of a URL.

## Why it matters

An attacker who controls or spoofs an MCP server can get arbitrary command execution on any machine that connects to it with mcp-remote, giving them a foothold to steal data, credentials, or pivot further into the network.

## What you can do

- Only connect mcp-remote to MCP servers you trust and control; treat third-party or community servers as untrusted input.
- Inspect OAuth metadata responses (especially authorization_endpoint) for shell metacharacters before allowing automated processing.
- Run mcp-remote in a sandboxed or least-privilege environment so command execution cannot reach sensitive data or credentials.
- Monitor outbound connections and process launches triggered by mcp-remote for unexpected shell commands.

## Known benign look-alikes

- Legitimate OAuth metadata documentation describing endpoint discovery for educational purposes.
- Security tooling that parses authorization_endpoint for vulnerability scanning.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00434
- https://nvd.nist.gov/vuln/detail/CVE-2025-6514

---
Source: https://www.netzilo.com/threats/atr-mcp-remote-authorization-endpoint-os-command-injection-cve-2