Threats tagged 'brew-mcp-inspector-cve-2025-58444'

CVE-2025-58444 is a high-severity cross-site scripting (XSS) vulnerability in the modelcontextprotocol (MCP) Inspector local development tool. The flaw occurs when the Inspector renders a redirect URL from a remote MCP server without proper neutralization of encoded URI schemes. Connecting to an untrusted server can allow crafted redirects to inject scripts into the Inspector context, potentially leading to arbitrary command execution on the developer's machine. Version 0.16.6 of the Inspector includes hardened URL handling and validation that prevents this script execution.