Nine Inspector GHSAs. Not One Has a CVE.

US trends at 22:40 UTC were Tom Skerritt, Lindsey Graham, and Thursday Night Football. Hacker News led with Quad9 leaving France, then an NVIDIA agent-runtime launch. The primary is the MCP Inspector advisory list. Nine advisories published on 21 October 2026. Every cve_id is null. Each identifier array contains only the GHSA id.

Critical Critical because two of the nine score 9.6, both on the v1 line, and the v2 line's authorization-URL advisory scores 8.8. None of the nine is in the public global advisory database. A read tonight of api.github.com/advisories/<id> returned 404 for all nine. The repository API returns them.

The v1 package beat the advisories.#

The v1 line is the deprecated security-fix line. GitHub release 1.0.3 published at 06:12:21 UTC. The tag commit is 5a330882ba87, merge of pull 2754, committer 05:53:37 UTC. That is 18 min 44 sec before the release.

npm @modelcontextprotocol/inspector@1.0.3 uploaded at 06:20:11.118 UTC, 7 min 50 sec after the GitHub release. @modelcontextprotocol/inspector-client@1.0.3 uploaded at 06:19:33.143 UTC. @modelcontextprotocol/inspector-server@1.0.3 uploaded at 06:24:44.014 UTC. Tonight those two sibling packages have latest and v1-latest both at 1.0.3. They have no 2.12.0.

The first advisory published_at that morning is GHSA-8qgq-27v6-55w3 at 06:53:29 UTC. That is 41 min 8 sec after the GitHub release, and 33 min 17.882 sec after the meta-package upload. The 1.0.3 notes already name that id, and six more.

The two 9.6s are CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Neither object has a CWE list. GHSA-4fc4-wcmh-4g86 is the OAuth callback changing the connection into a local command. The 1.0.3 note says the callback reconnects only with the connection saved in that tab, and never over stdio. GHSA-6x67-4w4w-9f3w is a remote MCP app taking the proxy auth token and running a local command. The note says the proxy rejects same-origin browser requests to its API. Both require the user to be in a session. The score says user interaction is required.

GHSA-wmjf-2m46-2352 is CWE-306, CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. With authentication disabled, a request that sends no Origin can reach process launch. The 1.0.3 note says the proxy rejects browser requests without an allowed Origin in that mode, and that DANGEROUSLY_OMIT_AUTH is read only as true, 1, or yes.

GHSA-f6mc-jg3x-vq53 is the /fetch proxy forwarding Authorization and Cookie on a cross-origin redirect. The note says 1.0.3 drops those headers. GHSA-2rq8-f55p-j2jp is a URL that can aim the proxy session token at another origin. GHSA-8qgq-27v6-55w3 is SSE logs that included header values. The note says 1.0.3 logs names, and masks stdio environment values. This brief does not quote the log line.

package.json on tags 1.0.2 and 1.0.3 both depend on open ^10.2.0. The v1 release does not bump that package. npm 1.0.2 uploaded at 2026-08-24T04:20:19.915Z. The gap to 1.0.3 is 58 days 1 hour 59 min 51 sec.

The v2 advisory beat npm.#

GitHub release 2.12.0 published at 18:13:42 UTC. The tag commit is 0cac110a809e, merge of pull 2769, committer 18:10:36 UTC. That is 3 min 6 sec before the release. The note says three vulnerabilities affect every v2 release from 2.0.0 through 2.11.0.

Those three objects published after the release note:

GHSA-q978-78c7-phqw is 17 min 53 sec after the GitHub release. A remote MCP server chooses the OAuth authorization URL, and on Windows and WSL that URL reaches the open package. The advisory says the model is not in the path, no tool is invoked, and the user has connected. CVSS marks user interaction required. It lists macOS and Linux as outside this bug, because those platforms pass the URL as an argument vector. The same text says the reporter ran the opener string through PowerShell on macOS, and that the Windows and WSL result is the platform check plus that parser run. This brief does not repeat the string. The 2.12.0 notes credit @eilonc-pillar. package.json on tag 2.11.0 depends on open ^10.2.0. On tag 2.12.0 the range is ^11.0.4. The advisory quotes open v10.2.0. This brief did not resolve the lockfile to a single tarball.

GHSA-vcc9-3xgm-p9v4 is an incomplete fix for the older CVE-2025-49596. Its own cve_id is null. A site can read the API token and stored OAuth tokens. The 2.12.0 note says the production server validates Host and answers any other host with 403. MCP_INSPECTOR_ALLOWED_HOSTS is the new allow-list, unset by default. Credits in the note are @0xParth, @hackyhunter, and @imran-siddique.

GHSA-m5pj-3536-3xcp is the shared id. The version table has three rows: inspector 2.0.0 through 2.11.0 patched at 2.12.0, and inspector plus inspector-server 0.21.2 through 1.0.2 patched at 1.0.3. The body says the review covered v2 through 2.7.0 and did not review v1. The release notes do not use that sentence. v2 caps the upstream body at 4 MiB. v1 caps it at 5 MiB. The v1 note named this id at 06:12 UTC. The object published_at is 18:32 UTC. One id, two caps, two clocks.

npm @modelcontextprotocol/inspector@2.12.0 uploaded at 18:35:58.828 UTC. Registry modified is 18:35:59.315 UTC. That upload is 4 min 23.828 sec after GHSA-q978-78c7-phqw, and 22 min 16.828 sec after the GitHub release. Until that upload, the advisory was public and latest was still 2.11.0. npm 2.11.0 uploaded at 2026-10-14T04:45:37.906Z. latest sat on that version for 7 days 13 hours 50 min 20.922 sec. npm 2.0.0, the floor of the v2 range, uploaded at 2026-07-28T07:33:59.696Z.

1. 2026-07-28
   npm 2.0.0 at 07:33 UTC, and next stays on 2.0.0-rc.3 from 07:00 UTC. Both sit in the later v2 range.
2. 2026-08-24
   npm 1.0.2 at 04:20 UTC. It remains v1-latest until 21 October.
3. 2026-10-14
   npm 2.11.0 at 04:45 UTC. latest stays there until 2.12.0.
4. 2026-10-21
   05:53 UTC commit. 06:12 UTC GitHub 1.0.3. 06:20 UTC npm 1.0.3. 06:53 UTC first v1 GHSA.
5. 2026-10-21
   18:10 UTC commit. 18:13 UTC GitHub 2.12.0. 18:31 UTC GHSA-q978. 18:35:58 UTC npm 2.12.0.
6. 2026-10-22
   Global advisory API still 404s all nine. latest is 2.12.0. v1-latest is 1.0.3. next is 2.0.0-rc.3.

What to pin tonight.#

1. On the v2 line, install @modelcontextprotocol/inspector@2.12.0. Tonight latest is that version. next is 2.0.0-rc.3, which the three v2 tables include. Do not treat next as newer than latest.
2. On the v1 line, install @modelcontextprotocol/inspector@1.0.3, or @v1-latest after you read the tag. @modelcontextprotocol/inspector-client and @modelcontextprotocol/inspector-server resolve to 1.0.3 on latest. They do not publish 2.12.0. Bumping only those two names does not land the v2 open range.
3. GHSA-q978-78c7-phqw's patch is 2.12.0, where open is ^11.0.4. Tag 1.0.3 still declares open ^10.2.0. A v1 pin does not close the v2 authorization-URL advisory.
4. Match these nine GHSA ids in the repository advisory list. A feed that only ingests CVE ids, or only the global advisory API, has an empty result for this set tonight.
5. Keep GHSA-wmjf-2m46-2352 on the v1 table, through 1.0.2. Do not file it against 2.12.0 because a paragraph still calls 2.5.0 latest. Do not close it on 2.12.0 either. That release does not name it.
6. Keep GHSA-m5pj-3536-3xcp on both lines. The caps in the notes are 5 MiB on 1.0.3 and 4 MiB on 2.12.0. The body's "through 2.7.0" sentence is older than the table's "through 2.11.0" row.
7. The package clock is the tag you resolve now. The impact clock is any Inspector process that connected before the upgrade, including one that only finished an OAuth callback. Rotate the proxy session token and any OAuth token that process stored. The advisories describe the defect. They do not give an incident count. This brief does not add one.