GHSA-g9hg-qhmf-q45m
MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @modelcontextprotocol/inspector | < 0.16.6 | 0.16.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
An XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. If the Inspector connects to an untrusted server, a crafted redirect can inject script into the Inspector context and, via the built-in proxy, be leveraged to trigger arbitrary command execution on the developer machine. Version 0.16.6 hardens URL handling/validation and prevents script execution.
> Thank you to the following researchers for their reports and contributions:
> * Raymond (Veria Labs)
> * Gavin Zhong, <[email protected]> & Shuyang Wang, <[email protected]>.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-g9hg-qhmf-q45m
- https://nvd.nist.gov/vuln/detail/CVE-2025-58444
- https://github.com/modelcontextprotocol/inspector/commit/650f3090d26344a672026b737d81586595bb1f60
- https://github.com/modelcontextprotocol/inspector
- https://www.npmjs.com/package/@modelcontextprotocol/inspector/v/0.16.6