MCP Inspector patches unauthenticated command execution in exposed proxies
The MCP Inspector advisory disclosed that versions before 0.14.1 could allow an unauthenticated attacker to use an exposed proxy to launch MCP commands on the host.
Why it matters: A diagnostic tool intended for local development can become a command-execution service when its proxy is bound or forwarded beyond a trusted machine.