IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-06-13 20:15

MODIFIED

2025-07-09 21:15

EPSS (Prob. Exploit)

44.45%

Top 1.2%

⚡ EPSS ÉLEVÉ (44.5%)

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-28 OSV 🔗 2026-03-01

> DESCRIPTION

The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-7f8r-222p-6f5g CRITICAL

MCP Inspector proxy server lacks authentication between the Inspector client and proxy

AFFECTED PACKAGES:

NPM / @modelcontextprotocol/inspector

< 0.14.1

Fixed in: 0.14.1

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

MCP Inspector proxy server lacks authentication between the Inspector client and proxy

AFFECTED PACKAGES:

Unknown / Unknown

27 versions affected

ALIASES:

GHSA-7f8r-222p-6f5g

> HISTORIQUE DES MODIFICATIONS

Première apparition

13/06/2025 20:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:05

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui