# CVE-2025-49596: MCP Inspector Fixes Nine Advisories on 21 October, Two Critical: a Malicious Server's OAuth Callback Switched Inspector to stdio and Ran a Local Command, and a Remote MCP App Stole the Proxy Token (CVSS 9.6)

> CVE-2025-49596 is a critical-severity remote code execution issue (CVSS 9.6) in @modelcontextprotocol/inspector, a MCP server. Affected: >=0.13.0 <1.0.3 || >=2.0.0 <2.12.0. Fixed in 2.12.0.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2025-49596
- **Aliases:** ti-163, GHSA-4fc4-wcmh-4g86
- **Severity:** critical
- **CVSS:** 9.6
- **Attack type:** Remote code execution
- **Component:** @modelcontextprotocol/inspector (MCP server)
- **Package:** @modelcontextprotocol/inspector
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-10-21
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2025-49596

## Summary

The maintainers of @modelcontextprotocol/inspector, the official MCP debugging client, published nine GitHub security advisories on 21 October 2026, fixed in 1.0.3 on the v1 line and 2.12.0 on the v2 line, and none has a CVE. Critical GHSA-4fc4-wcmh-4g86 (0.13.0 to 1.0.2): a remote MCP server answers with an OAuth challenge pointing at an attacker authorization server, which redirects the browser back to Inspector's /oauth/callback with transport=stdio&serverCommand=... appended; the callback page initialized its connection settings from the URL and reconnected after the token exchange, so the proxy spawned the attacker's command on macOS, Linux and Windows, with no tool call. Critical GHSA-6x67-4w4w-9f3w (CVSS 9.6, 0.20.0 to 1.0.2): a remote server's MCP App, rendered in a sandbox on the proxy's own origin, used ui/open-link to open an Inspector page with MCP_PROXY_FULL_ADDRESS pointing at the attacker, which leaked the proxy auth token from sessionStorage, then called the local /stdio endpoint with it. High GHSA-q978-78c7-phqw (2.0.0 to 2.11.0): on Windows and WSL a server-chosen OAuth authorization_endpoint containing a PowerShell $(...) subexpression ran code through open@10 while connecting, the same flaw as opencode's. High GHSA-vcc9-3xgm-p9v4 (2.0.0 to 2.11.0) and GHSA-wmjf-2m46-2352 (0.14.1 to 1.0.2) are incomplete fixes for CVE-2025-49596: requests without an Origin header passed the Origin check, so DNS rebinding could read the API token and stored OAuth tokens on 2.x, and with DANGEROUSLY_OMIT_AUTH set any local client could launch processes. The other four cover header leaks on cross-origin redirects, a token leak to a query-chosen proxy origin, verbatim logging of SSE auth headers, and an unbounded /api/fetch response.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| >=0.13.0 <1.0.3 \|\| >=2.0.0 <2.12.0 | 2.12.0 |

## Am I affected by CVE-2025-49596?

You are affected if you run @modelcontextprotocol/inspector >=0.13.0 <1.0.3 || >=2.0.0 <2.12.0. Versions 2.12.0 and later include the fix.

## How do I fix CVE-2025-49596?

Upgrade MCP Inspector to 2.12.0 (latest) or 1.0.3 (v1-latest) on every developer machine, and remember that npx @modelcontextprotocol/inspector resolves whatever is cached locally unless you pin the version. Do not point Inspector at remote MCP servers you do not trust on an older version, never run it with DANGEROUSLY_OMIT_AUTH, and keep it bound to loopback. If an older Inspector connected to an untrusted remote server, treat the machine as possibly compromised and revoke the OAuth tokens Inspector stored for connected servers.

## How do I find every machine running @modelcontextprotocol/inspector?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run @modelcontextprotocol/inspector and which version, then enforce a policy on it.

## References

- advisory: https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-4fc4-wcmh-4g86
- cve: https://nvd.nist.gov/vuln/detail/CVE-2025-49596

## Related vulnerabilities

- [CVE-2026-114090](https://catalog.anomity.ai/vuln/cve-2026-114090) — high
- [CVE-2026-114612](https://catalog.anomity.ai/vuln/cve-2026-114612) — critical
- [CVE-2026-32871](https://catalog.anomity.ai/vuln/cve-2026-32871) — critical
- [CVE-2026-96620](https://catalog.anomity.ai/vuln/cve-2026-96620) — critical
- [CVE-2026-105740](https://catalog.anomity.ai/vuln/cve-2026-105740) — critical
- [CVE-2026-111091](https://catalog.anomity.ai/vuln/cve-2026-111091) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2025-49596