CVE-2025-58444: MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server
An XSS issue was reported in the MCP Inspector local development tool when connecting to an untrusted remote MCP server with a malicious redirect URI. This could be leveraged to interact directly with the inspector proxy to trigger arbitrary command execution. Users are advised to update to 0.16.6 to resolve this issue.
Thank you to the following researchers for their reports and contributions: Raymond (Veria Labs) Gavin Zhong, superboyzjc@gmail.com & Shuyang Wang, swang@obsidiansecurity.com.
Other sources
The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported in versions of the MCP Inspector local development tool prior to 0.16.6 when connecting to untrusted remote MCP servers with a malicious redirect URI. This could be leveraged to interact directly with the inspector proxy to trigger arbitrary command execution. Users are advised to update to 0.16.6 to resolve this issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58444?
CVE-2025-58444 is considered a high severity vulnerability due to its potential for arbitrary command execution.
How do I fix CVE-2025-58444?
To fix CVE-2025-58444, ensure you update the @modelcontextprotocol/inspector package to version 0.16.7 or later.
Who is affected by CVE-2025-58444?
CVE-2025-58444 affects users of the @modelcontextprotocol/inspector package version 0.16.6 and below.
What kind of attack does CVE-2025-58444 enable?
CVE-2025-58444 enables an XSS attack through a malicious redirect URI when connecting to an untrusted remote MCP server.
What should I do if I cannot upgrade to fix CVE-2025-58444?
If you cannot upgrade, avoid connecting to untrusted remote MCP servers to mitigate the risk of CVE-2025-58444.