title: mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)
id: ATR-2026-00434
rule_version: 1
status: experimental
description: |
  Detects exploitation of CVE-2025-6514 (CVSS 9.6), OS command injection in mcp-remote when connecting to untrusted MCP servers. The vulnerable surface is the `authorization_endpoint` field returned in the OAuth metadata response: mcp-remote interpolates this URL into a shell context without sanitisation. Crafted shell metacharacters (`$()`, `\``, `;`, `|`, `&&`, `>(...)`, `\\$IFS`) inside the URL execute arbitrary OS commands on the client host. CWE-78. Disclosed by JFrog 2025-Q3.
author: ATR Community
date: 2026/05/10
schema_version: '0.1'
detection_tier: pattern
maturity: stable
severity: critical
references:
  owasp_llm:
    - LLM03:2025
    - LLM05:2025
  owasp_agentic:
    - ASI04:2026
    - ASI05:2026
  mitre_atlas:
    - AML.T0049 - Exploit Public-Facing Application
    - AML.T0010 - AI Supply Chain Compromise
  mitre_attack:
    - T1059 - Command and Scripting Interpreter
    - T1190 - Exploit Public-Facing Application
  cve:
    - CVE-2025-6514
metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: CVE-2025-6514 mcp-remote interpolates the authorization_endpoint URL from a server-controlled OAuth metadata response into a shell context, yielding arbitrary OS command execution on the MCP client; Article 15 cybersecurity requirements mandate that AI tool clients sanitise server-controlled fields used in command-string construction.
      strength: primary
    - article: '9'
      context: Article 9 risk management must enumerate server-controlled OAuth metadata as untrusted input — any field consumed by string formatting into a shell or process-spawn primitive is a high-risk RCE vector.
      strength: primary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Adversarial input attacks via MCP server metadata responses (authorization_endpoint, registration_endpoint, jwks_uri) reaching shell-exec sinks must be tracked and detected as a primary tool-supply-chain attack class.
      strength: primary
    - subcategory: MG.2.3
      context: Risk treatment under MG.2.3 must require URL-grammar validation on every server-supplied OAuth metadata field before any shell or subprocess use.
      strength: primary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)).
      strength: primary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: Operational controls under clause 8.1 must include detection of shell metacharacters in OAuth/OIDC discovery metadata fields consumed by MCP client tooling.
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)) as a treatment control.
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: mcp-oauth-metadata-injection
  scan_target: mcp
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - mcp-remote
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - Legitimate OAuth metadata documentation describing endpoint discovery for educational purposes.
    - Security tooling that parses authorization_endpoint for vulnerability scanning.
  conditions:
    - field: tool_response
      operator: regex
      value: (?i)"authorization_endpoint"\s*:\s*"https?://[^"]*(?:`|\$\(|\$IFS|\$\{IFS|&&|\|\||\|\s*[a-z]|>\(|;\s*[a-z]\w*\s*[;&|]|>\s*/[a-z])
      description: OAuth authorization_endpoint URL contains unambiguous shell metacharacters (backtick, $(, &&, ||, |cmd, command-chain, file-redirect) — direct CVE-2025-6514 signature
    - field: tool_response
      operator: regex
      value: (?i)"authorization_endpoint"\s*:\s*"[^"]*\$\([^)]+\)[^"]*"
      description: authorization_endpoint URL contains $(...) command substitution
    - field: tool_response
      operator: regex
      value: (?i)"authorization_endpoint"\s*:\s*"[^"]*`[^`]+`[^"]*"
      description: authorization_endpoint URL contains backtick command substitution
    - field: tool_response
      operator: regex
      value: (?i)"(?:authorization_endpoint|registration_endpoint|token_endpoint|jwks_uri|userinfo_endpoint|end_session_endpoint)"\s*:\s*"[^"]*(?:\$\(|`|;\s*[a-z]\w*\s*[;&|]|&&|\|\||>\s*/[a-z]|>\(|\$IFS|\$\{IFS)
      description: Any OAuth/OIDC metadata field URL contains unambiguous shell metacharacters — generalised auth-metadata injection
    - field: tool_response
      operator: regex
      value: (?i)"authorization_endpoint"\s*:\s*"[^"]*%(?:24|60|3b|7c|26)[^"]*"
      description: authorization_endpoint URL has URL-encoded shell metacharacters ($, `, ;, |, &) — encoded-bypass attempt
    - field: content
      operator: regex
      value: (?i)mcp-?remote[^\n]{0,80}(?:authorization_endpoint|oauth\s+metadata)[^\n]{0,200}(?:command\s+inject|os\s+command|rce|shell|cve-?2025-?6514)
      description: Skill/payload references mcp-remote authorization_endpoint command-injection — CVE-2025-6514 explicit
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-00434] CRITICAL: mcp-remote authorization_endpoint command- injection pattern detected (CVE-2025-6514, CVSS 9.6). MCP server metadata response contains shell metacharacters in an OAuth discovery URL field. Block the connection; treat the remote MCP server as hostile. Upgrade mcp-remote to the patched release and validate OAuth metadata fields with a strict URL grammar before any shell or subprocess use.
confidence: 88