Hub MCP Prompt Injection (Cross-Context)
Date: 2025-06
Affected: Hub MCP Prompt Injection (Cross-Context)
Attack vector: data-exfiltration
Category: real-world
Severity: Critical
CVE: CVE-2025-49596
CWE: CWE-306

A malicious web page could talk to the local MCP Inspector proxy (no auth) via DNS-rebinding/CSRF and drive it to run MCP commands over stdio, which leading to arbitrary OS command execution and data exfiltration.


Mitigations:

Architectural layers (MAESTRO):