• Project uses MCP Inspector v2 (@modelcontextprotocol/inspector) at version 2.7.0 or earlier.
• The Inspector Node backend's POST /api/fetch proxy route is in use for MCP traffic or OAuth work.
• Inspector connects to (or is redirected during OAuth/CIMD to) an untrusted or misbehaving server that can return a very large or unbounded response body.

Affected

@modelcontextprotocol/inspector >=2.0.0 <=2.11.0 · @modelcontextprotocol/inspector >=0.21.2 <=1.0.2 · @modelcontextprotocol/inspector-server >=0.21.2 <=1.0.2

Fixed in

2.12.0 · 1.0.3

ID

GHSA-m5pj-3536-3xcp

• Project runs MCP Inspector v1.0.0 or later, which includes the hand-rolled /fetch proxy redirect loop from commit d40c1c94.
• The Inspector proxy's /fetch endpoint is used to reach remote resources such as OAuth discovery/token endpoints.
• Proxied requests carry Authorization headers or Cookie headers.
• The user connects the Inspector to a malicious or compromised remote MCP server that can return a 3xx redirect to a different origin.

Affected

@modelcontextprotocol/inspector >=1.0.0 <=1.0.2 · @modelcontextprotocol/inspector-server >=1.0.0 <=1.0.2

Fixed in

1.0.3

ID

GHSA-f6mc-jg3x-vq53

Source summary

Details The tool injects the MCP App contents into a "sandbox". This sandbox can exec JS. And this sandbox's location is http://127.0.0.1: /sandbox . Proxy Server Protections Proxy has 2 layers of defence - 1. Origin check to block DNS Rebinding. It only adds client UI port in allowed origins. 2. Auth token validation with x-mcp-proxy-auth header. The origin check is a non blocker - since the malicious MCP app is running on proxy port, its "same origin" as proxy server. Browser's don't send origin header in same origin requests. js if (origin && !allowedOrigins.includes(origin)) { console.erro

Affected

@modelcontextprotocol/inspector >=0.20.0 <=1.0.2 · @modelcontextprotocol/inspector-client >=0.20.0 <=1.0.2 · @modelcontextprotocol/inspector-server >=0.20.0 <=1.0.2

Fixed in

1.0.3

ID

GHSA-6x67-4w4w-9f3w

• Project runs @modelcontextprotocol/inspector (confirmed vulnerable: 0.14.3, 1.0.2, or 2.5.0).
• Inspector is started with authentication disabled via DANGEROUSLY_OMIT_AUTH=true.
• Attacker can send direct non-browser HTTP requests without an Origin header to the Inspector server (port 6277 /stdio in v1, port 6274 /api/mcp/connect in v2).

Affected

@modelcontextprotocol/inspector >=0.14.1 <=1.0.2 · @modelcontextprotocol/inspector-server >=0.14.1 <=1.0.2

Fixed in

1.0.3

ID

GHSA-wmjf-2m46-2352

• Project runs the MCP Inspector proxy (server/src/index.ts with the SSE transport branch that logs forwarded headers).
• Inspector is used to connect to an upstream MCP server over the SSE transport (not streamable-http).
• The upstream SSE MCP server requires authentication via an Authorization bearer token or custom auth headers (x-custom-auth-header(s)).
• The Inspector proxy's stdout/logs are readable by someone other than the credential holder (terminal scrollback, Docker/Kubernetes logs, CI/devcontainer logs, support bundles).

Affected

@modelcontextprotocol/inspector >=0.14.2 <=1.0.2 · @modelcontextprotocol/inspector-server >=0.14.2 <=1.0.2

Fixed in

1.0.3

ID

GHSA-8qgq-27v6-55w3