Evidence · DiggingBeagle record
Advisory: MCP Inspector srcdoc iframe can navigate to hostile origin yet retain JSON-RPC bridge
An MCP Inspector App inside a srcdoc iframe could navigate its child frame to an attacker origin while the parent still trusted its persistent contentWindow reference for JSON-RPC. GHSA-h9j8-vj8g-v3gg demonstrated that wildcard postMessage bridging exposed replies and forwarded tool-call requests to the replacement document. The advisory identifies 2.14.0 as the fix; it does not prove deployed-tool misuse. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
- Source role
- primary disclosure
Evidence record
An MCP Inspector App inside a srcdoc iframe could navigate its child frame to an attacker origin while the parent still trusted its persistent contentWindow reference for JSON-RPC. GHSA-h9j8-vj8g-v3gg demonstrated that wildcard postMessage bridging exposed replies and forwarded tool-call requests to the replacement document. The advisory identifies 2.14.0 as the fix; it does not prove deployed-tool misuse. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Claim-level citations (2)
- supportsMCP Inspector retained an RPC tool bridge after untrusted iframe navigation: GHSA-h9j8-vj8g-v3gg demonstrated that wildcard postMessage bridging exposed replies and forwarded tool-call requests to the replacement document. The advisory identifies 2.14.0 as the fix; it does not prove deployed-tool misuse.
GHSA-h9j8-vj8g-v3gg; iframe navigation and JSON-RPC bridge
- supportsMCP Inspector retained an RPC tool bridge after untrusted iframe navigation: An MCP Inspector App inside a srcdoc iframe could navigate its child frame to an attacker origin while the parent still trusted its persistent contentWindow reference for JSON-RPC.
GHSA-h9j8-vj8g-v3gg; iframe navigation and JSON-RPC bridge