CVE-2025-58444: MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server

The vulnerability is a Cross-Site Scripting (XSS) issue in the MCP Inspector's OAuth flow, which can be escalated to arbitrary command execution. The root cause is the failure to properly validate the authorizationUrl received from a potentially malicious remote MCP server before using it in client-side redirects or links.

The analysis of the patch commit 650f3090d26344a672026b737d81586595bb1f60 reveals several locations where this untrusted URL was handled insecurely:

1. In AuthDebugger.tsx, a useEffect hook triggered an automatic redirect using window.location.href without any validation.
2. In OAuthFlowProgress.tsx, the URL was used directly in an <a> tag's href attribute and in a window.open call, both of which are vulnerable to javascript: URIs if a user clicks them.
3. In auth.ts, the InspectorOAuthClientProvider.redirectToAuthorization method had a weak protocol check before redirecting, which was insufficient.

A malicious server could provide an authorizationUrl with a javascript: scheme. When the MCP Inspector client processed this URL, it would execute the embedded script in the user's browser. According to the advisory, this XSS could then be used to interact with the inspector's proxy, leading to arbitrary command execution on the user's machine.

The fix involves introducing a new centralized utility function, validateRedirectUrl, which strictly ensures that any URL used for redirection has either an http: or https: protocol. This function is now called in all the previously vulnerable locations before the URL is used, effectively mitigating the XSS threat.