mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514) - ATR-2026-00434 (59349900-4f91-5f1e-a241-79eebbd7998c)
Detects exploitation of CVE-2025-6514 (CVSS 9.6), OS command injection in mcp-remote when connecting to untrusted MCP servers. The vulnerable surface is the authorization_endpoint field returned in the OAuth metadata response: mcp-remote interpolates this URL into a shell context without sanitisation. Crafted shell metacharacters ($(), \``,;,|,&&,>(...),\$IFS`) inside the URL execute arbitrary OS commands on the client host. CWE-78. Disclosed by JFrog 2025-Q3.