{"action":"Upgrade mcp-remote to 0.1.16 or later.","affected":[{"fixed":"0.1.16","introduced":"0.0.5"}],"component":"mcp-remote","cve_ids":["CVE-2025-6514"],"ecosystem":"npm","epss":0.77027,"exploited":false,"fixed_versions":["0.1.16"],"ghsa_id":"GHSA-6xpm-ggf7-wc3p","id":"tcs_01M5KF8AMR38TMHK82ZH3EYM0B","modified_at":"2025-07-09T19:42:17.822019Z","published_at":"2025-07-09T15:30:44Z","references":["https://osv.dev/vulnerability/GHSA-6xpm-ggf7-wc3p","https://nvd.nist.gov/vuln/detail/CVE-2025-6514","https://github.com/geelen/mcp-remote/commit/607b226a356cb61a239ffaba2fb3db1c9dea4bac","https://github.com/geelen/mcp-remote","https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability","https://research.jfrog.com/vulnerabilities/mcp-remote-command-injection-rce-jfsa-2025-001290844"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-6xpm-ggf7-wc3p","url":"https://osv.dev/vulnerability/GHSA-6xpm-ggf7-wc3p"}],"summary":"mcp-remote exposed to OS command injection via untrusted MCP server connections"}