https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 05:43:17 +0000 https://db.gcve.eu/vuln/cve-2025-58444 <p><strong>Affected:</strong> modelcontextprotocol inspector</p> <p>The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported in versions of the MCP Inspector local development tool prior to 0.16.6 when connecting to untrusted remote MCP servers with a malicious redirect URI. This could be leveraged to interact directly with the inspector proxy to trigger arbitrary command execution. Users are advised to update to 0.16.6 to resolve this issue.</p> <p><strong>Affected:</strong> modelcontextprotocol inspector</p> <p>The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported in versions of the MCP Inspector local development tool prior to 0.16.6 when connecting to untrusted remote MCP servers with a malicious redirect URI. This could be leveraged to interact directly with the inspector proxy to trigger arbitrary command execution. Users are advised to update to 0.16.6 to resolve this issue.</p> https://db.gcve.eu/vuln/cve-2025-58444 https://db.gcve.eu/vuln/ghsa-g9hg-qhmf-q45m <p><strong>Affected:</strong> npm: @modelcontextprotocol/inspector</p> <p>An XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. If the Inspector connects to an untrusted server, a crafted redirect can inject script into the Inspector context and, via the built-in proxy, be leveraged to trigger arbitrary command execution on the developer machine. Version 0.16.6 hardens URL handling/validation and prevents script execution.</p> <p>&gt; Thank you to the following researchers for their reports and contributions: &gt; * Raymond (Veria Labs) &gt; * Gavin Zhong, &lt;superboyzjc@gmail.com&gt; &amp; Shuyang Wang, &lt;swang@obsidiansecurity.com&gt;.</p> <p><strong>Affected:</strong> npm: @modelcontextprotocol/inspector</p> <p>An XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. If the Inspector connects to an untrusted server, a crafted redirect can inject script into the Inspector context and, via the built-in proxy, be leveraged to trigger arbitrary command execution on the developer machine. Version 0.16.6 hardens URL handling/validation and prevents script execution.</p> <p>&gt; Thank you to the following researchers for their reports and contributions: &gt; * Raymond (Veria Labs) &gt; * Gavin Zhong, &lt;superboyzjc@gmail.com&gt; &amp; Shuyang Wang, &lt;swang@obsidiansecurity.com&gt;.</p> https://db.gcve.eu/vuln/ghsa-g9hg-qhmf-q45m