MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server
An XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. If the Inspector connects to an untrusted server, a crafted redirect can inject script into the Inspector context and, via the built-in proxy, be leveraged to trigger arbitrary command execution on the developer machine. Version 0.16.6 hardens URL handling/validation and prevents script execution.
Thank you to the following researchers for their reports and contributions:
- Raymond (Veria Labs)
- Gavin Zhong, superboyzjc@gmail.com & Shuyang Wang, swang@obsidiansecurity.com.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @modelcontextprotocol/inspector | < 0.16.6 | 0.16.6 |
References
- https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-g9hg-qhmf-q45m
- https://nvd.nist.gov/vuln/detail/CVE-2025-58444
- https://github.com/modelcontextprotocol/inspector/commit/650f3090d26344a672026b737d81586595bb1f60
- https://github.com/modelcontextprotocol/inspector
- https://www.npmjs.com/package/@modelcontextprotocol/inspector/v/0.16.6
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-79, CWE-84, CWE-94- Platform
- npm
- Package
@modelcontextprotocol/inspector- Disclosed
- 08.09.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-g9hg-qhmf-q45m - CC BY 4.0
Vulnerability history: @modelcontextprotocol/inspector
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 06.2025 09.2025
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 1
Disclosures per year
- 2025: 2
- 2026: 0
-
MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.