MCP Inspector up to 1.0.2: two critical advisories that npm audit can't see yet

Written by MV2 of Munim, Inc. The research and text were made with AI agents working in his name. Every version range below was checked against the project's own GitHub security advisories on 30 October 2026.

If you build MCP servers, you have probably run the MCP Inspector (npx @modelcontextprotocol/inspector). On 21 October 2026 its maintainers published nine security advisories. None of them has a CVE ID. Two are critical (CVSS 9.6): through version 1.0.2, a malicious MCP server you connect the Inspector to can make it run commands on your machine.

Why your tools are probably quiet about it

The advisories are published on the Inspector repository and name npm packages and version ranges. But as of 30 October 2026, nine days later, the global advisory databases have no record of them:

• https://api.github.com/advisories/GHSA-4fc4-wcmh-4g86 returns 404 (the GitHub Advisory Database, which npm audit and Dependabot read);
• https://api.osv.dev/v1/vulns/GHSA-4fc4-wcmh-4g86 returns 404 (OSV.dev, which OSV-Scanner reads);
• the same goes for the second critical one (GHSA-6x67-4w4w-9f3w) and the Windows one on the 2.x line (GHSA-q978-78c7-phqw).

So npm audit can report a project that pins @modelcontextprotocol/inspector@1.0.2 as clean. Until the databases catch up, check the version yourself.

What is affected

On the 1.x line (fixed in 1.0.3):

Advisory	Severity	Versions	What
GHSA-4fc4-wcmh-4g86	Critical, 9.6	0.13.0 - 1.0.2	A hostile MCP server's OAuth callback can switch the Inspector to a local command of the server's choosing and run it
GHSA-6x67-4w4w-9f3w	Critical, 9.6	0.20.0 - 1.0.2	A remote MCP App can steal the proxy's auth token and run local commands through the proxy
GHSA-wmjf-2m46-2352	High, 7.5	0.14.1 - 1.0.2	Only with DANGEROUSLY_OMIT_AUTH: a client that sends no Origin header can start programs
GHSA-2rq8-f55p-j2jp	Medium, 5.3	0.14.1 - 1.0.2	The proxy session token can leak to a proxy address taken from the page's query string
GHSA-f6mc-jg3x-vq53	Medium	1.0.0 - 1.0.2	Authorization and Cookie headers are forwarded across cross-origin redirects
GHSA-m5pj-3536-3xcp	Medium	0.21.2 - 1.0.2	No size cap on proxied responses, so a server can exhaust memory
GHSA-8qgq-27v6-55w3	Low	0.14.2 - 1.0.2	SSE auth and custom headers are written verbatim to the proxy's log

On the 2.x line (fixed in 2.12.0):

Advisory	Severity	Versions	What
GHSA-q978-78c7-phqw	High, 8.8	2.0.0 - 2.11.0	On Windows and WSL, a remote MCP server can run code through the OAuth authorization URL (PowerShell injection)
GHSA-vcc9-3xgm-p9v4	High	2.0.0 - 2.11.0	Incomplete fix for CVE-2025-49596: a website using DNS rebinding can read the API token and stored OAuth tokens
GHSA-m5pj-3536-3xcp	Medium	2.0.0 - 2.11.0	Same memory-exhaustion issue as on 1.x

One inconsistency to know about: GHSA-wmjf's own write-up says 2.5.0 was confirmed vulnerable, but the advisory lists no 2.x range or fix. Whatever version you run, don't start the Inspector with DANGEROUSLY_OMIT_AUTH.

How to check and fix

1. Find the version you have: npm ls @modelcontextprotocol/inspector in each project that depends on it, and npm ls -g @modelcontextprotocol/inspector for a global install.
2. If you start it with npx, name the version so you know what runs: npx @modelcontextprotocol/inspector@1.0.3 on the 1.x line, or npx @modelcontextprotocol/inspector@latest (2.13.0 on 30 October 2026).
3. Connect it only to MCP servers you trust, and stop it when you're done. The 1.x proxy listens on port 6277 and the UI on 6274.

Two free tools can do the version check for you (both Apache-2.0, both updated on 30 October 2026 with these advisories):

• a browser checker at munimv2.github.io: pick "MCP Inspector", type your version, and it lists the advisories that affect it and the version that fixes them. Nothing you type leaves the page;
• local-ai-checkup 0.4.5, a read-only Python script with no dependencies. It looks for the Inspector proxy on port 6277, plus exposed Ollama, Open WebUI, n8n, vLLM and other self-hosted AI servers on your machine.

If you'd rather have someone go through a whole local AI setup with you, there's a paid review ($49 for one machine, $199 for up to five) described on the local-ai-checkup page. The free tools above are enough for the Inspector.

If a range here looks wrong, please say so in the comments and I'll correct it.

MV2, Munim, Inc., [e-mail]