GitHub Advisoryadvisory · npm

GHSA-g9hg-qhmf-q45m MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server

HIGH Published 2025-09-08 Modified 2025-09-26 Official page ↗
Aliases
CVE-2025-58444
Ecosystem
npm
Packages
@modelcontextprotocol/inspector
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-79, CWE-84, CWE-94
Reviewed
2025-09-08

Affected packages

• npm @modelcontextprotocol/inspector: < 0.16.6 → fixed in 0.16.6

Description

An XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. If the Inspector connects to an untrusted server, a crafted redirect can inject script into the Inspector context and, via the built-in proxy, be leveraged to trigger arbitrary command execution on the developer machine. Version 0.16.6 hardens URL handling/validation and prevents script execution. > Thank you to the following researchers for their reports and contributions: > * Raymond (Veria Labs) > * Gavin Zhong, & Shuyang Wang, .

Related

Alias · CVE (1)

  • CVE-2025-58444 The MCP inspector is a developer tool for testing and debugging MCP servers. vulnerability

Weakness · CWE (3)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-84 Improper Neutralization of Encoded URI Schemes in a Web Page weakness
  • CWE-94 Improper Control of Generation of Code weakness

References