High severityOSV Advisory· Published Sep 8, 2025· Updated Apr 15, 2026
CVE-2025-58444
CVE-2025-58444
Description
The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported in versions of the MCP Inspector local development tool prior to 0.16.6 when connecting to untrusted remote MCP servers with a malicious redirect URI. This could be leveraged to interact directly with the inspector proxy to trigger arbitrary command execution. Users are advised to update to 0.16.6 to resolve this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@modelcontextprotocol/inspectornpm | < 0.16.6 | 0.16.6 |
Affected products
2- Range: 0.0.1, 0.1.0, 0.10.2, …
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-g9hg-qhmf-q45mghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-58444ghsaADVISORY
- github.com/modelcontextprotocol/inspector/commit/650f3090d26344a672026b737d81586595bb1f60nvdWEB
- github.com/modelcontextprotocol/inspector/security/advisories/GHSA-g9hg-qhmf-q45mnvdWEB
- www.npmjs.com/package/@modelcontextprotocol/inspector/v/0.16.6ghsaWEB
News mentions
0No linked articles in our index yet.