CVE-2025-6514 PoC — mcp-remote 操作系统命令注入漏洞

Source

https://github.com/ChaseHCS/CVE-2025-6514

Associated Vulnerability

Title:mcp-remote 操作系统命令注入漏洞 (CVE-2025-6514)
Description:mcp-remote是Glen Maddern个人开发者的一个MCP链接软件。 mcp-remote存在操作系统命令注入漏洞，该漏洞源于连接不受信任MCP服务器时存在OS命令注入。

Description

Documentation for CVE-2025-6514. MCP-Remote RCE.

Readme

# CVE-2025-6514
Documentation for CVE-2025-6514. MCP-Remote arb code execution.

## To-do list

1. Figure out how to setup Vast.ai 4090 instance.
2. Setup LLama or Gemma model locally on the instance. Be able to successfully query the model.
3. Setup MCP-Remote. Successfully send JSON calls to MCP 0.15.
4. Successfully achieve code execution!

File Snapshot


 [4.0K]  /data/pocs/9206781e17b8c998b9f102c0843ba40e7c03ad77
└── [ 345]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!