@flinkhouse/servers (0.6.2), @iflow-mcp/alibabacloud-dataworks-mcp-server (1.0.43) +10 more potentially affected by CVE-2025-53110 via @modelcontextprotocol/server-filesystem (>=0.6.2, <=2025.3.28)

@modelcontextprotocol/server-filesystem NPM version =0.6.2, =1.0.0, =0.5.0, =0.6.2, =1.0.40, =1.0.7, =2.0.1, =0.1.7, =0.2.9 Source cves: CVE-2025-53110 Source advisory: MEND:CVE-2025-53110...

@kakashi-ventures-accelerator/catalyst-cli (0.1.0), @mew-protocol/mew (>=0.5.0, <=0.11.0) +1 more potentially affected by CVE-2025-53110 via @modelcontextprotocol/server-filesystem (0.6.2)

@modelcontextprotocol/server-filesystem NPM version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/server-filesystem and may be impacted: - @kakashi-ventures-accelerator/catalyst-cli 0.1.0 - @mew-protocol/mew =0.5.0, =0.11....

@iflow-mcp/alibabacloud-dataworks-mcp-server (1.0.43), @mseep/alibabacloud-dataworks-mcp-server (1.0.36) +1 more potentially affected by CVE-2025-53110 via @modelcontextprotocol/server-filesystem (2025.3.28)

@modelcontextprotocol/server-filesystem NPM version 2025.3.28 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/server-filesystem and may be impacted: - @iflow-mcp/alibabacloud-dataworks-mcp-server 1.0.43 -...

@kakashi-ventures-accelerator/catalyst-cli (0.1.0), @mew-protocol/mew (>=0.5.0, <=0.11.0) +1 more potentially affected by CVE-2025-53109 via @modelcontextprotocol/server-filesystem (0.6.2)

@modelcontextprotocol/server-filesystem NPM version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/server-filesystem and may be impacted: - @kakashi-ventures-accelerator/catalyst-cli 0.1.0 - @mew-protocol/mew =0.5.0, =0.11....

@iflow-mcp/alibabacloud-dataworks-mcp-server (1.0.43), @mseep/alibabacloud-dataworks-mcp-server (1.0.36) +1 more potentially affected by CVE-2025-53109 via @modelcontextprotocol/server-filesystem (2025.3.28)

@modelcontextprotocol/server-filesystem NPM version 2025.3.28 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/server-filesystem and may be impacted: - @iflow-mcp/alibabacloud-dataworks-mcp-server 1.0.43 -...

Remote Code Execution (RCE)

@modelcontextprotocol/inspector is vulnerable to Remote Code Execution RCE. The vulnerability is due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio...

@cyanheads/git-mcp-server (>=2.0.10, <=2.1.0), @dsazz/mcp-confluence (0.2.0) +34 more potentially affected by CVE-2025-49596 via @modelcontextprotocol/inspector (>=0.2.7, <=0.13.0)

@modelcontextprotocol/inspector NPM version =0.2.7, =2.0.10, =1.0.1, =0.0.0-alpha.0, =1.0.0, =0.1.0, =0.1.2 and more Source cves: CVE-2025-49596 Source advisory: OSV:GHSA-7F8R-222P-6F5G...

@cyanheads/git-mcp-server (>=2.0.10, <=2.1.0), @dsazz/mcp-confluence (0.2.0) +34 more potentially affected by CVE-2025-49596 via @modelcontextprotocol/inspector (>=0.2.7, <=0.13.0)

@modelcontextprotocol/inspector NPM version =0.2.7, =2.0.10, =1.0.1, =0.0.0-alpha.0, =1.0.0, =0.1.0, =0.1.2 and more Source cves: CVE-2025-49596 Source advisory: GHSA-7F8R-222P-6F5G...

@cyanheads/git-mcp-server (>=2.0.10, <=2.1.0), @dsazz/mcp-confluence (0.2.0) +34 more potentially affected by CVE-2025-49596 via @modelcontextprotocol/inspector (>=0.2.7, <=0.13.0)

@modelcontextprotocol/inspector NPM version =0.2.7, =2.0.10, =1.0.1, =0.0.0-alpha.0, =1.0.0, =0.1.0, =0.1.2 and more Source cves: CVE-2025-49596 Source advisory: MEND:CVE-2025-49596...