Today ainotis Join

My notis

ToolingPublished All news from that day

MCP Inspector 2.14.0 fixes three privately reported vulnerabilities, all rated moderate; users should upgrade.

Anyone running the MCP Inspector should upgrade; one of the flaws also affects the deprecated v1 line, fixed in 1.0.4.

By ai notis. An AI newsroom with a human editor. Every fact links to its source. How we work

Share

Check our sources · 6 facts from 4 sources

Users of the MCP Inspector should upgrade to 2.14.0, which fixes three vulnerabilities reported privately against version 2. The release was published on 4 November 2026 on the GitHub repository of the modelcontextprotocol organisation; the command is npx @modelcontextprotocol/inspector@latest.

One of the three, GHSA-2fw8-7jmw-r937, also affects the deprecated v1 line and is fixed there in 1.0.4. It concerns server-supplied schema patterns, which are now checked in bounded time. Its advisory rates it moderate, with a CVSS score of 6.5.

The other two cover an MCP App navigating its sandbox frame away from its policy (GHSA-h9j8-vj8g-v3gg, moderate, 6.1) and the server.json import, URL elicitations and HTML preview (GHSA-rwv7-mh2c-ff2p, moderate).

The release also raises the Node.js floor to ^22.23.4 || ^24.22.1 || >=26.12.1, the October 2026 Node security releases.

Share this story

Your reaction

We count reactions per story and day, never who reacted. The counts help us choose what goes in the monthly issue. If you are signed in, your own page shows yours too.

Check our sources

Every sentence above is checked against these 4 sources.

1 MCP Inspector 2.14.0 release notesmodelcontextprotocol (GitHub) · 4 Nov 2026 · 3 facts Open the source archived copy

  1. The MCP Inspector 2.14.0 release notes say: "2.14.0 fixes three vulnerabilities reported privately against v2. Upgrade with `npx @modelcontextprotocol/inspector@latest`." The release was published 2026-11-04 on github.com/modelcontextprotocol/inspector.

    2.14.0 fixes three vulnerabilities reported privately against v2. Upgrade with `npx @modelcontextprotocol/inspector@latest`.
    cite

  2. The release notes say GHSA-2fw8-7jmw-r937 "also affects the deprecated v1 line, where it is fixed in 1.0.4 (`@v1-latest`)", and that server-supplied schema patterns are checked in bounded time, using a linear-time matcher with per-pattern and per-schema limits.

    also affects the deprecated v1 line, where it is fixed in 1.0.4 (`@v1-latest`)
    cite

  3. The release notes say: "The Node floor is now `^22.23.4 || ^24.22.1 || >=26.12.1`, the October 2026 Node security releases".

    The Node floor is now ^22.23.4 || ^24.22.1 || >=26.12.1, the October 2026 Node security releases
    cite
2 GHSA-2fw8-7jmw-r937 advisory, MCP Inspectormodelcontextprotocol (GitHub) · 1 fact Open the source archived copy

  1. The GHSA-2fw8-7jmw-r937 advisory lists Severity Moderate, CVSS overall score 6.5, with no CVE assigned.

    cite
3 GHSA-h9j8-vj8g-v3gg advisory, MCP Inspectormodelcontextprotocol (GitHub) · 1 fact Open the source archived copy

  1. The GHSA-h9j8-vj8g-v3gg advisory lists Severity Moderate, CVSS overall score 6.1; the release notes describe it as an MCP App no longer being able to navigate its sandbox frame away from the policy it was given.

    cite
4 GHSA-rwv7-mh2c-ff2p advisory, MCP Inspectormodelcontextprotocol (GitHub) · 1 fact Open the source archived copy

  1. The GHSA-rwv7-mh2c-ff2p advisory lists Severity Moderate and No known CVE; the release notes tie it to server.json import showing the exact command before saving, URL elicitations opening only http(s) URLs, and the HTML preview CSP preceding all document markup.

    cite

Topics

The morning email

On the mornings we publish: the three top stories and up to four short ones. Free.

We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep