Tracking: resolve open Dependabot and code scanning security alerts

[cliffhall]

Summary

Tracking issue for the open GitHub security alerts on this repository. This covers both:

• Dependabot alerts — https://github.com/modelcontextprotocol/inspector/security/dependabot
• Code scanning alerts — https://github.com/modelcontextprotocol/inspector/security/code-scanning

As of triage there are 17 open Dependabot alerts and 1 open code scanning alert. Items are grouped so that alerts fixable by a single dependency bump / PR share one checkbox, with the individual alerts bulleted underneath. Resolve each by upgrading the affected dependency (or applying a fix), or dismiss with a rationale if it doesn't apply to how the Inspector uses it.

Code scanning

• Critical — SSRF fix in server/src/index.ts
  • #53 js/request-forgery — Server-side request forgery

Dependabot

• hono upgrade (High + Medium)

  • #126 High — CORS middleware reflects any Origin with credentials when origin defaults to wildcard
  • #128 Medium — Body Limit middleware bypass on AWS Lambda via understated Content-Length
  • #127 Medium — Lambda@Edge adapter keeps only last value of a repeated request header
  • #125 Medium — Path traversal in serve-static on Windows via encoded backslash (%5C)
  • #124 Medium — AWS Lambda adapter merges multiple Set-Cookie headers, dropping cookies

• minimatch upgrade (High)

  • #69 High — ReDoS: matchOne() combinatorial backtracking via non-adjacent GLOBSTAR segments
  • #66 High — ReDoS: nested *() extglobs generate catastrophically backtracking regexes
  • #61 High — ReDoS via repeated wildcards with non-matching literal in pattern

• vite upgrade (High + Medium)

  • #123 High — server.fs.deny bypass on Windows alternate paths
  • #129 Medium — launch-editor (transitive): NTLMv2 hash disclosure via UNC path handling on Windows

• js-yaml upgrade (Medium)

  • #134 Medium — Quadratic-complexity DoS in merge key handling via repeated aliases
  • #133 Medium — Quadratic-complexity DoS in merge key handling via repeated aliases

• shell-quote upgrade (Critical)

  • #120 Critical — quote() does not escape newlines in object .op values

• vitest upgrade (Critical)

  • #119 Critical — arbitrary file read/execute when Vitest UI server is listening

• form-data upgrade (High)

  • #130 High — CRLF injection via unescaped multipart field names and filenames

• @babel/core upgrade (Low)

  • #132 Low — Arbitrary file read via sourceMappingURL comment

• esbuild upgrade (Low)

  • #121 Low — arbitrary file read when running the dev server on Windows

---

Counts and links captured at time of filing; check the Security tab for the current live state.

[cliffhall]

PRs opened (one per group)

Group	Alerts	PR
shell-quote (Critical)	#120	#1711
vitest (Critical)	#119	#1707
hono	#126, #128, #127, #125, #124	#1708
vite	#123, #129	#1709
minimatch	#69, #66, #61	#1715
form-data	#130	#1710
js-yaml	#134, #133	#1713
esbuild	#121	#1714
@babel/core	#132	#1712

Each PR applies the minimal fix (direct bump or a targeted overrides entry), verifies the vulnerable version is gone via npm ls, and passes the local check suite: prettier --check, check-version, client lint, client tests (535), cli tests (85), and npm run build. E2e (Playwright) was not run locally and is left to CI.

Note

Heads-up on CI formatting: main currently has pre-existing Prettier drift on 5 client source files under the latest Prettier (3.9.5), while the lockfile pins 3.7.4. Because CI runs npx prettier --check . before npm install, it fetches the latest Prettier and this step will show red on these PRs regardless of their changes. This should be addressed separately (reformat + pin, or run the format check after install).