MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting, Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79 and CWE-94.
Summary
The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported in versions of the MCP Inspector local development tool prior to 0.16.6 when connecting to untrusted remote MCP servers with a malicious redirect URI. This could be leveraged to interact directly with the inspector proxy to trigger arbitrary command execution. Users are advised to update to 0.16.6 to resolve this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MLflow | inspector | before 0.16.6 | 0.16.6 | Patch available | CNA |
| — | @modelcontextprotocol/inspector (npm) | before 0.16.6 | 0.16.6 | Patch available | GHSA-g9hg-qhmf-q45m |
- inspector VendorMLflow Affected before 0.16.6 Fixed in 0.16.6 Patch available CNA
- @modelcontextprotocol/inspector (npm) Vendor— Affected before 0.16.6 Fixed in 0.16.6 Patch available GHSA-g9hg-qhmf-q45m
Remediation
- Fix · CNA inspector (modelcontextprotocol) Fixed in 0.16.6
- Fix · GHSA-g9hg-qhmf-q45m @modelcontextprotocol/inspector (npm) Fixed in 0.16.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-58444
- 2026-10-03 Alias added: GHSA-g9hg-qhmf-q45m
References
Other 4
- https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-g9hg-qhmf-q45m
- https://github.com/modelcontextprotocol/inspector/commit/650f3090d26344a672026b737d81586595bb1f60
- https://github.com/modelcontextprotocol/inspector
- https://www.npmjs.com/package/@modelcontextprotocol/inspector/v/0.16.6
More MLflow vulnerabilities
- TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
- TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
- TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
- TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
- TI-2026-81527 Code execution via scorer deserialization in MLflow servers CVSS 3.1CRITICAL 9.8
- TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
Sources
- CVE-2025-58444 · CVE Program
- CVE-2025-58444 · NVD
- FIRST EPSS
- GHSA-g9hg-qhmf-q45m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences