ACVE-2025-0001

The configuration

Configuration label

@modelcontextprotocol/inspector

Affected entries

• npm: @modelcontextprotocol/inspector — SEMVER (introduced 0; fixed 0.14.1)
• MCP: pkg:npm/@modelcontextprotocol/inspector — SEMVER (introduced 0; fixed 0.14.1)

Matcher

• some mcpServers
  • package eq "pkg:npm/@modelcontextprotocol/inspector"

Why it is exploitable

What the vulnerability is

MCP Inspector is a developer tool that places a local proxy between an MCP client and an MCP server. The referenced advisory describes a flaw in versions before 0.14.1 where local authentication could be bypassed and browser-origin behavior could be combined with localhost rebinding. That can let an unintended requester reach the Inspector's MCP-facing operations.

Which configuration is exposed

The exposed combination is any configuration that launches or installs @modelcontextprotocol/inspector as an MCP server. ACVE's matcher encodes only the server package identity pkg:npm/@modelcontextprotocol/inspector; it does not require a particular harness, transport, host binding, or permission mode. Thus the finding applies when the Inspector package is present in mcpServers, including a development setup where it is started through a package runner.

How ACVE detects it

ACVE reads mcpServers[].package and matches the Inspector package PURL. It does not read mcpServers[].resolvedVersion, determine whether the Inspector proxy is bound to loopback, or prove that authentication is disabled. A package launched through npx may have no resolved version in the lockfile, so the finding is deliberately broad and should be treated as a possible match until the running package is checked.

Fix

1. Upgrade the Inspector package to 0.14.1 or later.
2. Re-check the launch configuration and keep the Inspector proxy limited to the intended local developer boundary; do not expose it as a network service.

The package match is useful for development environments as well as production-like integrations because Inspector is itself the component being launched.

References

See references for primary sources.

Underlying CVEs / aliases

• CVE-2025-49596

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Upgrade MCP Inspector to 0.14.1 or later and keep its proxy local.

Validation

Grounding

• OSV: found; aliases: CVE-2025-49596, GHSA-7f8r-222p-6f5g; checked-at 2026-09-20T02:43:20Z
• NVD: found; checked-at 2026-09-20T02:43:20Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:20Z

References

ADVISORY

• https://nvd.nist.gov/vuln/detail/CVE-2025-49596

REPORT

• https://example.com/research/acve

FIX

• https://github.com/pickbitsai/acve/issues?q=CVE-2025-49596