References https://nvd.nist.gov/vuln/detail/CVE-2025-6514 https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability https://research.jfrog.com/vulnerabilities/mcp-remote-command-injection-rce-jfsa-2025-001290844/ https://github.com/advisories/GHSA-6xpm-ggf7-wc3p https://thehackernews.com/2025/07/critical-mcp-remote-vulnerability.html https://security.snyk.io/vuln/SNYK-JS-MCPREMOTE-10734125 https://www.tenable.com/cve/CVE-2025-6514 https://github.com/geelen/mcp-remote/commit/607b226a356cb61a239ffaba2fb3db1c9dea4bac https://blog.csdn.net/athink_cn/article/details/149241305 https://vulnerablemcp.info/vuln/cve-2025-6514-mcp-remote-rce.html
Related VulnerabilitiesPoCCVE-2026-26216: Crawl4AI < 0.8.0 - Unauthenticated Remote Code Execution via Hooks ParameterPoCCVE-2026-40281: Gotenberg <= 8.30.1 - Remote Code ExecutionPoCCVE-2026-86242: Bifrost < 1.6.3 - Unauthenticated Remote Plugin URL FetchPoCCRMEB /api/remote_register 权限绕过漏洞PoCCVE-2025-62593: Ray < 2.52.0 - Remote Code ExecutionPoCCVE-2026-1340: Ivanti EPMM < 12.8.0.0 - Remote Code ExecutionPoCCVE-2026-86218: N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code ExecutionPoCCVE-2026-0768: Langflow <=1.2.x - Unauthenticated Remote Code Execution via validate_codePoCCVE-2026-2113: tpadmin <= 1.3.12 - Remote Code ExecutionPoCCVE-2026-34234: CtrlPanel <= 1.1.1 - Remote Code ExecutionPoCCVE-2026-41679: Paperclip - Remote Code ExecutionPoCCVE-2026-5562: Provectus kafka-ui <=0.7.2 - Remote Code ExecutionPoCCVE-2026-58123: Hermes WebUI < 0.51.788 - Remote Code Execution