Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
An XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. If the Inspector connects to an untrusted server, a crafted redirect can inject script into the Inspector context and, via the built-in proxy, be leveraged to trigger arbitrary command execution on the developer machine. Version 0.16.6 hardens URL handling/validation and prevents script execution. Thank you to the following researchers for their reports and contributions: Raymond (Veria Labs) Gavin Zhong, <superboyzjc@gmail.com & Shuyang Wang, <swang@obsidiansecurity.com.
Recommended action: Upgrade to 0.16.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities. Credit: Rémy Marot <bughunters@tenable.com
Recommended action: Upgrade to 0.14.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.