Executive brief
mcp-remote is an npm library that enables remote protocol connections to Model Context Protocol (MCP) servers. When connecting to an untrusted or compromised MCP server, the library fails to properly sanitize URLs from the server's authorization endpoint response, allowing an attacker to inject arbitrary OS commands. An attacker can exploit this to execute commands on a user's system with the privileges of the user running mcp-remote.
Technical details
The vulnerability is a command injection flaw (CWE-78) in mcp-remote versions 0.0.5 through 0.1.15. The root cause is insufficient sanitization of the authorization_endpoint URL returned by an untrusted MCP server. When a user connects to a malicious or compromised MCP server, the server can craft a malicious URL response that gets passed unsafely to system command execution. The attack requires the user to initiate a connection to an attacker-controlled MCP server, but does not require authentication or other preconditions beyond user interaction. A fix was implemented in version 0.1.16 by adding proper escaping of URL components (username/password) before use in shell commands. The vulnerability was disclosed and patched on 2025-07-09.
Affected products
- mcp-remote project mcp-remote 0.0.5 through 0.1.15
Timeline
- 2025-07-09: disclosed
- 2025-07-09: patched: Fixed in version 0.1.16