Threats affecting pkg:brew/mcp-inspector

MCP Inspector versions 0.14.2 up to but not including 0.16.6 contain a cross-site scripting (XSS) vulnerability. This flaw occurs when the tool renders a redirect URL from a remote MCP server without sufficient validation. If the Inspector connects to an untrusted server, an attacker can craft a redirect that injects malicious script into the Inspector's context. This script can then leverage the built-in proxy to execute arbitrary commands on the developer's machine. Version 0.16.6 includes hardened URL handling and validation that prevents this script execution.