Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain

CVE-2025-49596 is a missing-authentication flaw (CWE-306) in the MCP Inspector, a developer tool for testing and debugging Model Context Protocol (MCP) servers: the Inspector's proxy component accepts unauthenticated requests from the client, which allows unauthenticated requests to launch MCP commands over stdio. An attacker who can reach the proxy while a developer is running the Inspector (CVSS 4.0 indicates network attack vector with user interaction required, consistent with a malicious page or request reaching the developer's machine) can trigger these command launches without any credentials. Successful exploitation yields remote code execution on the developer's machine with the privileges of the Inspector process, which is why the flaw is rated 9.4 (critical) on the CVSS 4.0 scale with high impact across confidentiality, integrity, and availability. Affected users are developers running any MCP Inspector version below 0.14.1 on their workstations; this is a developer-tool flaw, not a production-server flaw, so only machines actively running the tool are exposed at any given time. No public proof-of-concept or confirmed in-the-wild exploitation is currently known and the issue is not yet in CISA's KEV catalog, but EPSS assigns a 42.7% probability of exploitation within 30 days (99th percentile), indicating high near-term risk.

Do: Upgrade MCP Inspector to version 0.14.1 or later immediately on all developer machines. Until upgraded, do not keep the Inspector or its proxy component running while browsing untrusted websites or handling untrusted content, and shut it down when not actively debugging. Audit developer workstations and CI images for running or installed Inspector instances and verify the installed version is 0.14.1 or later.

CVE-2025-54136 is a command-injection flaw (CWE-78) in the Cursor AI code editor, versions 1.2.4 and below, in which changes to a previously trusted Model Context Protocol (MCP) configuration are not re-validated, letting a trusted command be silently swapped for an attacker-controlled one. The issue is triggered when an attacker with write permissions on the user's active branches of a source repository containing already-approved MCP servers — or with arbitrary local file-write on the victim's machine — modifies the trusted MCP configuration file; after the user accepts an innocuous MCP entry, the attacker can replace it with a malicious command without any warning or re-prompt. Successful exploitation yields remote and persistent arbitrary code execution on the developer's machine because the established MCP trust bypasses the prompts that would normally expose the change. Only Cursor 1.2.4 or earlier is affected; practical exposure additionally requires the user to have previously approved MCP servers whose configuration is attacker-writable. No public proof-of-concept or confirmed in-the-wild exploitation is known, though EPSS assigns a 27.1% probability of exploitation within 30 days (98th percentile) and CISA has not added it to the KEV catalog.

Do: Upgrade Cursor to version 1.3 or later. Until then, closely review and version-control MCP configuration files in shared repositories (require pull-request review for changes to approved MCP entries) and audit currently approved MCP server commands for unexpected edits, since swaps to already-trusted entries occur with no warning or re-prompt. Treat the fix as urgent given the high EPSS probability of near-term exploitation.

@akoskm/create-mcp-server-stdio is an MCP server starter kit that uses the StdioServerTransport. Prior to version 0.0.13, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. The MCP Server exposes the tool `which-app-on-port` which relies on Node.js child process API `exec` which is an unsafe and vulnerable API if concatenated with untrusted user input. Version 0.0.13 contains a fix for the issue.

An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page.

LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbitrary commands without validation, allowing any authenticated user to execute shell commands as root inside the container through a single API request. This vulnerability is fixed in v0.8.2-rc2.

WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, there is a command injection vulnerability that allows authenticated users to inject stdio_config.command/args into MCP stdio settings, causing the server to execute subprocesses using these injected values. This issue has been patched in version 0.2.5.

DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.16.0, an attacker accessing both the official DocsGPT website or any local and public deployment, can craft a malicious payload bypassing the "MCP test" behavior to achieve arbitrary remote code execution (RCE). This issue has been patched in version 0.16.0.

A prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute arbitrary commands on a victim system. When Windsurf processes attacker-controlled HTML content, malicious instructions can cause unauthorized modification of the local MCP configuration and automatic registration of a malicious MCP STDIO server, resulting in execution of arbitrary commands without further user interaction. Successful exploitation may allow attackers to execute commands on behalf of the user, persist malicious MCP configuration changes, and access sensitive information exposed through the application.

LangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server configuration and execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and arguments. When the MCP server is started and MCP is enabled for agent execution, subsequent agent activity triggers execution of arbitrary commands on the server. Successful exploitation allows arbitrary command execution within the context of the LangChain-ChatChat service.

xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulting in execution of arbitrary commands on the server. Successful exploitation allows arbitrary command execution within the context of the Fay service.

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling attackers to run arbitrary operating system commands. Successful exploitation may result in remote code execution with the privileges of the LiteLLM process.

Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature. The application allows users to define MCP servers using a JSON configuration containing arbitrary command and args values. These values are executed by the application when the configuration is applied without sufficient validation or restriction. An attacker may supply a malicious MCP configuration to execute arbitrary operating system commands, potentially resulting in remote code execution with the privileges of the Agent Zero process.

Upsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality. The application allows users to define MCP tasks with arbitrary command and args values. Although an allowlist exists, certain allowed commands (npm, npx) accept argument flags that enable execution of arbitrary OS commands. Maliciously crafted MCP tasks may lead to remote code execution with the privileges of the Upsonic process. In version 0.72.0 Upsonic added a warning about using Stdio servers being able to execute commands directly on the machine.

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution. The vulnerability lies in a bug in the input sanitization from the “Custom MCP” configuration in http://localhost:3000/canvas - where any user can add a new MCP, when doing so - adding a new MCP using stdio, the user can add any command, even though your code have input sanitization checks such as validateCommandInjection and validateArgsForLocalFileAccess, and a list of predefined specific safe commands - these commands, for example "npx" can be combined with code execution arguments ("-c touch /tmp/pwn") that enable direct code execution on the underlying OS. This vulnerability is fixed in 3.1.0.