Snyk Security Database

@mcpjam/inspector is a MCPJam Inspector

Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the connect route in the HTTP API. An attacker can execute arbitrary commands on the host system by sending a crafted HTTP request containing malicious command and args fields, which are processed without authentication or authorization checks.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the valueDecoder function in decoder.py. An attacker can cause memory exhaustion by submitting a malformed RELATIVE-OID containing excessive continuation octets.

Affected versions of this package are vulnerable to External Control of File Name or Path via the processing of externally-supplied credential configuration files. An attacker can access arbitrary files or perform server-side request forgery by providing a crafted configuration with malicious credential_source.file paths or credential_source.url endpoints.