CVE-2025-49596
CRITICAL EXPLOITED NUCLEIMCP Inspector < 0.14.1 - Unauthenticated Remote Code Execution via Stdio Command Injection
Title source: llmExploitation Summary
CVE-2025-49596 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 5 public exploits from researchers including adminlove520, acseguin21, pppxo. A Nuclei detection template is also available.
AI-analyzed exploit summary The PoC exploits an RCE vulnerability in MCPJam inspector by sending crafted JSON payloads to the /api/mcp/connect endpoint, downloading a reverse shell script, and executing it. It uses curl to fetch the payload and chmod to make it executable.
Description
The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.
Exploits (5)
The PoC exploits an RCE vulnerability in MCPJam inspector by sending crafted JSON payloads to the /api/mcp/connect endpoint, downloading a reverse shell script, and executing it. It uses curl to fetch the payload and chmod to make it executable.
This repository contains a functional CTF lab demonstrating CVE-2025-49596, a session isolation failure in an MCP server where admin OAuth tokens leak into user responses due to a shared mutable context object. The exploit is embedded in the lab's design, allowing participants to extract flags via DevTools.
This PoC exploits CVE-2025-49596, an RCE vulnerability in MCPJam inspector versions prior to 1.4.2. It leverages the `/api/mcp/connect` endpoint to execute arbitrary commands via crafted JSON payloads, ultimately delivering a reverse shell to the attacker.
The repository contains a functional Python-based PoC for CVE-2025-49596, targeting an unauthenticated RCE vulnerability in MCP Inspector's SSE endpoint. The exploit constructs malicious requests to execute arbitrary commands via URL parameters.
This script checks for CVE-2025-49596 by sending a crafted HTTP request to the MCP Inspector SSE endpoint and analyzing the response. It detects the absence of authentication requirements, indicating potential vulnerability.
Nuclei Templates (1)
title="MCP Inspector"
References (4)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H