GHSA-2fw8-7jmw-r937: 
JavaScript Análise e mitigação de vulnerabilidades

Summary

After a user calls a tool on a malicious MCP server, the server can return a result that triggers catastrophic backtracking in its advertised outputSchema.pattern. Inspector validates that result synchronously on the UI path, so the app can become unresponsive.

Details

Inspector treats a remote server’s outputSchema as trusted validator input. After a tool call it runs the server’s schema (including any pattern) against the server’s structuredContent on the main thread with no complexity limit or timeout. Key locations (v2, reviewed revision 0cac110a809e93753fa353810b9b4c91e89810fc): core/mcp/inspectorClient.ts (~4214-4219, 4313-4318): calls validateToolOutput after receiving the result and constructs an AjvJsonSchemaValidator. core/mcp/toolOutputValidation.ts (~41-43): compiles and executes the validator synchronously: const validate = provider.getValidator(tool.outputSchema as JsonSchemaType); const validation = validate(structured); return validation.valid ? undefined : validation.errorMessage; A classic ReDoS pattern such as ^(a+)+$ combined with a near-match string of as produces exponential slowdown. Bounded local tests with AJV 8.20.0 showed clear nonlinear growth (tens to hundreds of ms at ~20–26 characters; longer inputs become practical stalls).

Proof of concept

1. Run a malicious MCP server that advertises a tool whose outputSchema contains a ReDoS pattern, e.g.: { "type": "object", "properties": { "data": { "type": "string", "pattern": "^(a+)+$" } } }
2. On tool call, return a near-match payload, e.g. a long string of as that fails only at the end.
3. Connect to the server with Inspector v2 and invoke the tool. Observed behavior (helper-level probe):

~5–46 ms at 20 as ~289–300 ms at 26 as Exponential trend continues with longer inputs, stalling the synchronous validation path.

Impact

A connected malicious MCP server can make the Inspector unresponsive while processing the tool result. The user must initiate the connection and the tool call. No established information disclosure, integrity violation, or remote code execution. A validator timeout or worker isolation would mitigate it.