The MCP Inspector preview builder used a regex that could place Content-Security-Policy text inside a fake HTML head inside a comment, and a separate elicitation flow opened caller-supplied URLs without limiting their scheme. GHSA-rwv7-mh2c-ff2p treats these as additional preview and URL trust failures. The actual consequence is browser and platform…
Inspect the ClaimsCase · DiggingBeagle record
MCP Inspector preview controls trusted fake HTML heads and unchecked URL schemes
The MCP Inspector preview builder used a regex that could place Content-Security-Policy text inside a fake HTML head inside a comment, and a separate elicitation flow opened caller-supplied URLs without limiting their scheme. GHSA-rwv7-mh2c-ff2p treats these as additional preview and URL trust failures.
Public disclosure: Nov 5, 2026
Scope
Reported security vulnerability; exploitation prerequisites and tested version scope matter. No real-world exploitation is established unless separately reported.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
research demonstration; demonstrated. The cited primary disclosure supports the specific sequence and boundaries described here: An untrusted MCP App supplies HTML with a commented fake head or an elicitation request containing a non-web URL scheme. The evidence does not independently establish consequences beyond the record's supported outcome; a numerical impact band cannot be justified from the available evidence. Evidence grade C reflects the source attribution and independent verification limits.
Assessed Nov 7, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB07-024-OUTCOME · CLM-DB07-024-MECHANISM · Advisory: MCP Inspector server.json import conceals executable runtime arguments from review UI
At a glance
Insert CSP using robust document parsing and enforce HTTPS/HTTP URL schemes at the action boundary.
Read the implicationsNo proved arbitrary native code execution or real data theft; URL consequences browser/OS dependent; independent roots from manifest args.
Limits and uncertaintyFull account
The MCP Inspector preview builder used a regex that could place Content-Security-Policy text inside a fake HTML head inside a comment, and a separate elicitation flow opened caller-supplied URLs without limiting their scheme.
GHSA-rwv7-mh2c-ff2p treats these as additional preview and URL trust failures. The actual consequence is browser and platform dependent; native code execution or real-world data theft was not established.
This Case contains two distinct browser-validation failures reported in one MCP Inspector advisory, but neither is the hidden-command-line-argument problem documented separately. The preview HTML builder could match a fake head marker inside a comment, placing protective CSP text where the rendered document would not enforce it. In an unrelated elicitation path, a UI action opened a server-supplied URL without restricting schemes to HTTP or HTTPS. The resulting effects vary with browser and operating system; a native-code exploit or actual theft is not demonstrated. Both issues were reported fixed in Inspector 2.14.0, and regression tests must cover the true parsed document head and final URL scheme.
These are two different browser-trust failures in the same inspection interface. Placing a CSP meta tag inside an HTML comment does not protect the actual rendered document, while opening an unvalidated elicitation URL delegates scheme handling to browser or operating-system behavior. Neither automatically proves native code execution. They also differ from the Inspector's retained iframe RPC bridge: that defect concerns continued tool authority after navigation, even if the rendered preview's CSP is correct.
Mechanism and trust boundary
- 01
An untrusted MCP App supplies HTML with a commented fake head or an elicitation request containing a non-web URL scheme.
- 02
The Inspector's regex-based CSP insertion or URL-opening handler accepts the raw input without effective parsed-document or scheme validation.
- 03
The browser can execute a preview without the intended CSP or open a disallowed scheme; the exact result depends on client platform.
Claims & evidence
CLM-DB07-024-OUTCOMEGHSA-rwv7-mh2c-ff2p treats these as additional preview and URL trust failures. The actual consequence is browser and platform dependent; native code execution or real-world data theft was not established.supported
Basis: reported finding
- supportsAdvisory: MCP Inspector server.json import conceals executable runtime arguments from review UIprimary disclosure
GHSA-rwv7-mh2c-ff2p; wrapHtmlWithCsp and ElicitationUrlModalBody
CLM-DB07-024-MECHANISMThe MCP Inspector preview builder used a regex that could place Content-Security-Policy text inside a fake HTML head inside a comment, and a separate elicitation flow opened caller-supplied URLs without limiting their scheme.supported
Basis: reported finding
- supportsAdvisory: MCP Inspector server.json import conceals executable runtime arguments from review UIprimary disclosure
GHSA-rwv7-mh2c-ff2p; wrapHtmlWithCsp and ElicitationUrlModalBody
Implications
Insert CSP using robust document parsing and enforce HTTPS/HTTP URL schemes at the action boundary.
Unknowns and contradictions
- No proved arbitrary native code execution or real data theft; URL consequences browser/OS dependent; independent roots from manifest args.
Sources and citation
Material revision history
- Nov 7, 2026 · Published version · first publication · revision 227