# MCP Inspector: an MCP App escapes the CSP meant to contain it

> MCP Inspector, the official tool for testing MCP servers, let a malicious app read private tool results and call tools in the user's name.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** Model Context Protocol
- **Disclosed:** 2026-11-04
- **CVSS:** 6.1
- **Affects:** MCP Inspector, @modelcontextprotocol/inspector
- **Research by:** [CloneOfAlex](https://github.com/CloneOfAlex), [KillerX345](https://github.com/KillerX345), MCP Inspector maintainers
- **Primary source:** https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-h9j8-vj8g-v3gg
- **Page:** https://theinjection.dev/items/mcp-inspector-2-14-0-app-frame-escape/

MCP Inspector 2.13.0 and earlier let a malicious MCP App leave its sandbox frame and keep the bridge to the host, one of three advisories the project published on November 4 and 5, 2026. Fixes ship in 2.14.0 and 1.0.4.

## What happened

The Model Context Protocol project fixed three moderate flaws in MCP Inspector on November 4 and 5, 2026, shipping releases 2.14.0 and 1.0.4. CloneOfAlex reported the frame escape and KillerX345 reported a stall in tool output validation. The third advisory, covering input validation in server.json imports, names no reporter.

## How it works

The frame escape abuses the web client's opaque-origin sandbox for MCP Apps. An app navigates its own inner frame to an attacker-controlled origin, and because the sandbox flags survive that navigation, the attacker's page still has a null origin and still passes the proxy's source check. The proxy keeps relaying host messages to it with a wildcard target origin, so tool results flow out to the attacker and a posted tools/call request flows back in as though the app had sent it.

## Who is affected

Versions 2.0.0 through 2.13.0 of @modelcontextprotocol/inspector carry the frame escape and the server.json validation flaw, and the schema regex flaw also reaches the deprecated 1.x line up to 1.0.3. Only the web client's MCP Apps tab is exposed to the frame escape: the advisory states that CLI and TUI users are not affected, nor are apps loaded from a dedicated origin.

## What to do

Upgrade to MCP Inspector 2.14.0, or to 1.0.4 on the deprecated 1.x line. On affected versions, treat the per-app connectDomains allowlist as an unreliable egress boundary and do not use the web client to review third-party MCP Apps.

## Quick facts

- **Affected:** @modelcontextprotocol/inspector 2.0.0 to 2.13.0; 1.x up to 1.0.3
- **Fixed in:** 2.14.0, and 1.0.4 on the 1.x line
- **CVE:** None assigned
- **Found by:** CloneOfAlex, KillerX345
- **Disclosed:** November 4 and 5, 2026
- **Attack type:** Malicious MCP server or app
- **Status:** Patched

## Questions

### Which MCP Inspector versions are patched against the MCP App frame escape?

MCP Inspector 2.14.0 contains the fix for all three November 2026 advisories, and the deprecated 1.x line is fixed in 1.0.4 for the tool output schema flaw only. Versions 2.0.0 through 2.13.0 are affected by the frame escape and the server.json validation issue. Upgrade with npx @modelcontextprotocol/inspector@latest, as the release notes instruct.

### Am I affected if I only use the MCP Inspector CLI?

MCP Inspector CLI and TUI users are not exposed to the frame escape, according to advisory GHSA-h9j8-vj8g-v3gg, which limits that flaw to the web client's MCP Apps tab. Apps loaded from a dedicated origin are also unaffected. The tool output schema flaw, however, can stall any Inspector that connects to a malicious server, so upgrading is still the right move.

### How does this differ from the MCP Inspector advisories published in October 2026?

The October 21, 2026 batch included two critical flaws that let a malicious MCP server or app run local commands on the machine running Inspector. The three November advisories are all rated moderate and none gives code execution. They cover an egress and bridge takeover in the web client, weak validation of imported server.json files, and a regex that can stall tool result validation.

## Sources

1. [Frame Escape Advisory](https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-h9j8-vj8g-v3gg)
2. [Server.json Advisory](https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-rwv7-mh2c-ff2p)
3. [Schema Regex Advisory](https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-2fw8-7jmw-r937)
4. [Inspector 2.14.0](https://github.com/modelcontextprotocol/inspector/releases/tag/2.14.0)