Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-58444

Good to know:

icon

Date: September 8, 2025

The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported in versions of the MCP Inspector local development tool prior to 0.16.6 when connecting to untrusted remote MCP servers with a malicious redirect URI. This could be leveraged to interact directly with the inspector proxy to trigger arbitrary command execution. Users are advised to update to 0.16.6 to resolve this issue.

Severity Score

Related Resources (6)

https://www.npmjs.com/package/@modelcontextprotocol/inspector/v/0.16.6
https://github.com/modelcontextprotocol/inspector
https://github.com/modelcontextprotocol/inspector/commit/650f3090d26344a672026b737d81586595bb1f60
https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-g9hg-qhmf-q45m
https://nvd.nist.gov/vuln/detail/CVE-2025-58444
https://www.mend.io/vulnerability-database/CVE-2025-58444

Severity Score

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

Improper Control of Generation of Code ('Code Injection')

CWE-94

Improper Neutralization of Encoded URI Schemes in a Web Page

CWE-84

Top Fix

icon

Upgrade Version

Upgrade to version @modelcontextprotocol/inspector - 0.16.6;https://github.com/modelcontextprotocol/inspector.git - 0.16.6

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us