@arturl/pulumi-mcp-server (0.1.9), @collegue/mcp (>=1.0.1, <=1.0.2) +76 more potentially affected by CVE-2025-58444 via @modelcontextprotocol/inspector-client (>=0.1.0, <=0.15.0)

@modelcontextprotocol/inspector-client NPM version =0.1.0, =1.0.1, =2.0.10, =0.0.0-semantically-released, =1.0.1, =0.0.0-alpha.0, =0.1.0, =0.1.0, =2.1.0, =2.1.1 - @iflow-mcp/cliffhall-gooseteam 0.3.0 - @iflow-mcp/dify-mcp-server-ts 1.0.0 - @iflow-mcp/dify-workflow-mcp 1.0.0 and more Source cves:...

Cross-site Scripting (XSS)

Overview @modelcontextprotocol/inspector-client is a Client-side application for the Model Context Protocol inspector Affected versions of this package are vulnerable to Cross-site Scripting XSS via the redirect URI parameter when connecting to an untrusted remote server. An attacker can execute...