# MCP Inspector Malicious Redirect URI XSS Payload

- **Severity:** High
- **Signature ID:** `4c1e2a9d-7f3b-4a68-9c2e-1d5b8a4f6e2c`

## Summary

This detects an attack where a malicious MCP server sends a booby-trapped redirect_uri during OAuth login instead of a normal callback link. The trap contains HTML or JavaScript code that runs inside the developer's Inspector tool when it processes the redirect.

## How the attack works

A remote MCP server the developer connects to initiates an OAuth authorization flow and supplies a redirect_uri parameter. Instead of a normal URL, the parameter contains injected markup: a script tag, a javascript: URI, an inline event handler like onerror=, or a data:text/html payload. When the vulnerable MCP Inspector (versions before 0.16.6) processes this redirect, the injected code executes in the Inspector's UI, giving the attacker a foothold to interact with the local inspector proxy. This detection only sees the network request carrying the poisoned redirect_uri — it cannot see the script actually executing in the browser.

## Why it matters

An attacker who controls or compromises an MCP server can run arbitrary script inside a developer's Inspector session, potentially reaching the local inspector proxy and whatever it has access to on that machine.

## What you can do

- Upgrade MCP Inspector to 0.16.6 or later.
- Treat any MCP server you don't fully trust as a potential attacker in the OAuth flow — validate redirect_uri values server-side before use.
- Review any matches for authorized scanner traffic (ZAP, Burp, internal red-team) before treating them as incidents.
- Check flagged redirect_uri values for legitimate exceptions, such as javascript:void(0) placeholders in popup-based OAuth flows or asset URLs containing the word 'javascript', before escalating.

## Known benign look-alikes

- Legacy OAuth/implicit-flow clients (including some Google API client libraries) that intentionally set redirect_uri=javascript:void(0) as a no-op placeholder for postMessage-based popup authentication — excluded explicitly by filter.
- Automated web security scanners (ZAP, Burp Suite, internal red-team tooling) deliberately probing an MCP server's OAuth endpoints for XSS as part of authorized testing — will legitimately match and should be reviewed, not treated as a true incident.
- A redirect_uri value that legitimately points to a file whose name contains the substring "javascript" (e.g. .../assets/javascript-sdk.js) combined with an unrelated onload= attribute elsewhere in the same query string — rare, but possible with verbose CDN asset URLs; review before escalating.

## References

- https://github.com/modelcontextprotocol/inspector/security/advisories

---
Source: https://www.netzilo.com/threats/mcp-inspector-redirect-uri-xss