Threats affecting pkg:github/mcpjam/inspector

CVE-2026-23744 is a critical remote code execution vulnerability in MCPJam inspector versions 1.4.2 and earlier. The flaw arises because the application listens on all network interfaces (0.0.0.0) by default and lacks authentication for a critical function that installs an MCP server. An attacker can exploit this by sending a crafted HTTP request remotely, triggering server installation and arbitrary code execution without any user interaction or privileges. The vulnerability has a CVSS score of 9.8, indicating a severe risk to confidentiality, integrity, and availability.