CVE-2025-58444: MCP Inspector XSS to RCE Vulnerability

CVE-2025-58444 Overview

CVE-2025-58444 is a cross-site scripting (XSS) vulnerability in the Model Context Protocol (MCP) Inspector, a developer tool used to test and debug MCP servers. The flaw exists in versions prior to 0.16.6 and is triggered when the inspector connects to an untrusted remote MCP server that supplies a malicious OAuth redirect URI. An attacker can leverage the XSS condition to interact directly with the inspector proxy, leading to arbitrary command execution on the developer's host. The issue is classified under [CWE-84: Improper Neutralization of Encoded URI in a Web Page]. Maintainers released version 0.16.6 to address the issue.

Critical Impact

A malicious remote MCP server can deliver a crafted redirect URI that executes arbitrary commands on a developer machine running the MCP Inspector.

Affected Products

• Model Context Protocol Inspector versions prior to 0.16.6
• Local development environments that connect MCP Inspector to untrusted remote MCP servers
• Downstream tooling that bundles the vulnerable @modelcontextprotocol/inspector package

Discovery Timeline

• 2025-09-08 - CVE-2025-58444 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-58444

Vulnerability Analysis

The MCP Inspector ships a browser-based client that orchestrates an OAuth authorization flow against a remote MCP server. The pre-patch client renders OAuth-supplied values, including the redirect_uri, without validating that the URL conforms to an expected scheme or origin. A remote MCP server controlled by an attacker can return a redirect URI containing a javascript: payload or other active-content scheme. When the inspector renders this value, the script executes in the context of the inspector UI.

Because the inspector UI is the privileged front end for the local inspector proxy, script execution in that origin grants the attacker an authenticated channel to the proxy. The proxy exposes endpoints capable of spawning local processes against MCP servers, so the XSS condition escalates into arbitrary command execution on the developer's workstation.

Root Cause

The root cause is missing input validation on OAuth redirect URLs before they are reflected in the client. The patch introduces a dedicated validateRedirectUrl helper imported from @/utils/urlValidation and applies it in both AuthDebugger.tsx and OAuthFlowProgress.tsx. The helper enforces that redirect URLs use safe schemes, preventing javascript: and similar active-content URIs from reaching the DOM.

Attack Vector

Exploitation requires the developer to initiate an MCP Inspector session against an attacker-controlled remote MCP server. User interaction is required to start the connection, after which the malicious server returns OAuth metadata containing the crafted redirect URI. The inspector renders the URI, the embedded script executes, and the attacker pivots from the inspector UI to the local proxy to run commands.

// Patch excerpt: client/src/components/AuthDebugger.tsx
 import { OAuthFlowProgress } from "./OAuthFlowProgress";
 import { OAuthStateMachine } from "../lib/oauth-state-machine";
 import { SESSION_KEYS } from "../lib/constants";
+import { validateRedirectUrl } from "@/utils/urlValidation";

 export interface AuthDebuggerProps {
   serverUrl: string;

// Patch excerpt: client/src/components/OAuthFlowProgress.tsx
 import { DebugInspectorOAuthClientProvider } from "@/lib/auth";
 import { useEffect, useMemo, useState } from "react";
 import { OAuthClientInformation } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { validateRedirectUrl } from "@/utils/urls/Validation";
+import { useToast } from "@/lib/hooks/useToast";

Source: GitHub Commit 650f3090

Detection Methods for CVE-2025-58444

Indicators of Compromise

• OAuth redirect_uri values containing non-HTTP schemes such as javascript:, data:, or vbscript: returned by an MCP server
• Outbound connections from developer workstations to unknown or newly registered MCP server endpoints
• Unexpected child processes spawned by the MCP Inspector proxy (Node.js parent) shortly after an OAuth flow

Detection Strategies

• Inspect package manifests and lockfiles for @modelcontextprotocol/inspector versions earlier than 0.16.6
• Monitor browser-side console logs and proxy access logs for requests originating from the inspector UI immediately after OAuth callbacks
• Hunt for process trees where the inspector proxy spawns shells, package managers, or scripting interpreters that fall outside normal debugging activity

Monitoring Recommendations

• Log and alert on developer endpoints that connect MCP Inspector to remote MCP servers outside an approved allowlist
• Capture HTTP traffic from the inspector to local proxy endpoints and review for anomalous command parameters
• Track installations and upgrades of the inspector package across developer fleets to verify patched versions are deployed

How to Mitigate CVE-2025-58444

Immediate Actions Required

• Upgrade @modelcontextprotocol/inspector to version 0.16.6 or later on every developer workstation
• Restrict the inspector to local or trusted MCP servers until the upgrade is verified
• Audit any prior inspector sessions that connected to untrusted remote MCP servers for signs of command execution

Patch Information

The fix is delivered in MCP Inspector 0.16.6 via commit 650f3090d26344a672026b737d81586595bb1f60. The patch adds a validateRedirectUrl utility and applies it to the OAuth flow components so that malicious schemes in redirect URIs are rejected before rendering. Full advisory details are available in GitHub Security Advisory GHSA-g9hg-qhmf-q45m.

Workarounds

• Only connect the MCP Inspector to MCP servers that are local or fully trusted
• Run the inspector inside an isolated virtual machine or container so any command execution is contained
• Block egress from developer workstations to unapproved MCP endpoints at the network layer

# Upgrade the MCP Inspector to the patched release
npm install -g @modelcontextprotocol/inspector@0.16.6

# Verify the installed version
npx @modelcontextprotocol/inspector --version