MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server
- Severity:
- High
Description
An XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. If the Inspector connects to an untrusted server, a crafted redirect can inject script into the Inspector context and, via the built-in proxy, be leveraged to trigger arbitrary command execution on the developer machine.
Recommendation
Update the @modelcontextprotocol/inspector package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.16.6
- Patched version(s): 0.16.6
References
Related Issues
- Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages - CVE-2025-59417
- Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE - CVE-2025-64495
- MCP Inspector proxy server lacks authentication between the Inspector client and proxy - CVE-2025-49596
- [Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions - @theia/task - CVE-2026-44691
You might also like:
- Tags:
- npm
- @modelcontextprotocol/inspector
Anything's wrong? Let us know Last updated on September 26, 2025