@modelcontextprotocol/inspector-client has 3 advisories. Version not read yet.
npm ↗Versions
Red: affected by at least one advisory. White: safe. The dot is the version in your lockfile.
Details
- You run
- not in lockfile
- Safe
- 1.0.3
- Advisories
- 3 in 120 days
Used by
Stacks that pull this package.
Not part of a tracked stack.
Alerts(3)
- Project uses @modelcontextprotocol/inspector (tested version 0.21.2).
- The MCP Inspector client has a proxy session token (MCP_PROXY_AUTH_TOKEN) configured, e.g. prefilled by default at startup.
- The user opens a crafted Inspector URL whose MCP_PROXY_FULL_ADDRESS query parameter points to an attacker-controlled HTTP endpoint.
- Affected
- @modelcontextprotocol/inspector >=0.14.1 <=1.0.2 · @modelcontextprotocol/inspector-client >=0.14.1 <=1.0.2
- Fixed in
- 1.0.3
- ID
- GHSA-2rq8-f55p-j2jp
Source summary
Details The tool injects the MCP App contents into a "sandbox". This sandbox can exec JS. And this sandbox's location is http://127.0.0.1: /sandbox . Proxy Server Protections Proxy has 2 layers of defence - 1. Origin check to block DNS Rebinding. It only adds client UI port in allowed origins. 2. Auth token validation with x-mcp-proxy-auth header. The origin check is a non blocker - since the malicious MCP app is running on proxy port, its "same origin" as proxy server. Browser's don't send origin header in same origin requests. js if (origin && !allowedOrigins.includes(origin)) { console.erro
- Affected
- @modelcontextprotocol/inspector >=0.20.0 <=1.0.2 · @modelcontextprotocol/inspector-client >=0.20.0 <=1.0.2 · @modelcontextprotocol/inspector-server >=0.20.0 <=1.0.2
- Fixed in
- 1.0.3
- ID
- GHSA-6x67-4w4w-9f3w
Source summary
Summary A malicious remote MCP server can abuse the OAuth callback to switch MCP Inspector from the original remote HTTP transport to stdio and execute an arbitrary local command. Details 1. The user connects to an attacker-controlled remote MCP server. 2. The server returns an OAuth challenge and points Inspector to an attacker-controlled authorization server. 3. After authorization, the attacker redirects the browser to Inspector’s callback URL and appends Inspector configuration parameters: text /oauth/callback ?code=valid-code &state=valid-state &transport=stdio &serverCommand= &serverArgs
- Affected
- @modelcontextprotocol/inspector >=0.13.0 <=1.0.2 · @modelcontextprotocol/inspector-client >=0.13.0 <=1.0.2
- Fixed in
- 1.0.3
- ID
- GHSA-4fc4-wcmh-4g86