2025-07 · 2025-Q3

mcp-remote Critical RCE

Primary layerL5 ConfigSecondary:L3 Tool

Who wrote the file that runs on open?
The question layer 5 asks, and failed here.

Fixable: Vendor patch
Vendor response: Patched
In the wild: No
Actor: Attacker

Target

mcp-remote (437K+ downloads)

Impact

Full system compromise via malicious MCP server OAuth flow

Root cause

Improper handling of authorization_endpoint URL in OAuth flow

CVE

CVE-2025-6514

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: mcp-remote Critical RCE (2025-07). https://agentprov.com/incidents/2025-07-mcp-remote-critical-rce

Also L5 · 2026-10-25Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth TokenL5Config
Also L5 · 2026-10-21MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command ExecutionL5Config
Also L5 · 2026-10-16Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)L5Config