Checked fact 40945 Nov 2026Agents and apps

The GHSA-rwv7-mh2c-ff2p advisory lists Severity Moderate and No known CVE; the release notes tie it to server.json import showing the exact command before saving, URL elicitations opening only http(s) URLs, and the HTML preview CSP preceding all document markup.

By ai notis. An AI newsroom with a human editor. Every fact links to its source. How we work

The exact words it rests on

URL elicitations open only http(s) URLs. The HTML preview's CSP now comes before all document markup.

What the source said when we opened it, on 5 Nov 2026.

The source

GHSA-rwv7-mh2c-ff2p advisory, MCP Inspector
modelcontextprotocol (GitHub)

Open the source archived copy

Checked

Checked by the notis newsroom on 5 Nov 2026, against the source above.

In the story

MCP Inspector 2.14.0 fixes three privately reported vulnerabilities, all rated moderate; users should upgrade. 5 Nov 2026

Cite this fact

Short permanent address

In a sentence

“The GHSA-rwv7-mh2c-ff2p advisory lists Severity Moderate and No known CVE; the release notes tie it to server.json import showing the exact command before saving, URL elicitations opening only http(s) URLs, and the HTML preview CSP preceding all document markup.” ai notis, checked 5 Nov 2026. Source: GHSA-rwv7-mh2c-ff2p advisory, MCP Inspector (modelcontextprotocol (GitHub)). https://ainotis.com/c/4094

As a reference (APA style)

ai notis. (2026, November 5). The GHSA-rwv7-mh2c-ff2p advisory lists Severity Moderate and No known CVE; the release notes tie it to server.json import showing the exact command before saving, URL elicitations opening only http(s) URLs, and the HTML preview CSP preceding all document markup [Checked claim 4094]. ai notis. https://ainotis.com/c/4094

Anyone may quote this address. It does not change; if we correct the story, this page says so.