{"action":"Upgrade @modelcontextprotocol/inspector to 0.14.1 or later.","affected":[{"fixed":"0.14.1","introduced":"0"}],"component":"@modelcontextprotocol/inspector","cve_ids":["CVE-2025-49596"],"ecosystem":"npm","epss":0.44453,"exploited":false,"fixed_versions":["0.14.1"],"ghsa_id":"GHSA-7f8r-222p-6f5g","id":"tcs_01M5KF9SH98YZ0A9V3V06VEDVW","modified_at":"2025-07-09T20:18:37Z","published_at":"2025-06-13T22:15:26Z","references":["https://osv.dev/vulnerability/GHSA-7f8r-222p-6f5g","https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-7f8r-222p-6f5g","https://nvd.nist.gov/vuln/detail/CVE-2025-49596","https://github.com/modelcontextprotocol/inspector/commit/50df0e1ec488f3983740b4d28d2a968f12eb8979","https://github.com/modelcontextprotocol/inspector","https://thenewstack.io/mcp-vulnerability-exposes-the-ai-untrusted-code-crisis","https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596"],"severity":{"label":"critical","score":9.4},"sources":[{"source":"osv","source_id":"GHSA-7f8r-222p-6f5g","url":"https://osv.dev/vulnerability/GHSA-7f8r-222p-6f5g"},{"source":"nvd","source_id":"CVE-2025-49596","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49596"}],"summary":"MCP Inspector proxy server lacks authentication between the Inspector client and proxy"}