The Vulnerable MCP Project — MCP vulnerability database

What it is

The page is a flat list of ~50 distinct MCP vulnerability entries. The existing summary names the major categories and several headline CVEs, but the raw list carries specific version boundaries, CVSS scores, and mechanisms for individual items that the summary compresses or omits entirely.

How it works (selected entries not covered by the summary)

mcp-remote proxy RCE — versions 0.0.5 through 0.1.15 allow full client-OS remote code execution when connecting to an untrusted server: a malicious server crafts an authorization_endpoint response that triggers OS command injection. CVSS 9.6. The page calls this the first documented instance of full RCE on the client OS originating from a remote MCP server.

Cursor IDE trust-persistence bypass — versions ≤1.2.4 trust previously approved MCP configs indefinitely with no re-approval on modification. Attack sequence: attacker commits a benign MCP config to a shared repo → waits for user approval → swaps in a malicious payload → persistent RCE. CVSS 7.2-8.8.

Cursor case-sensitivity bypass — a case-sensitivity bug on case-insensitive filesystems (Windows/macOS) lets attackers bypass file protection on .cursor/mcp.json to inject malicious MCP servers and achieve RCE.

mcp-server-kubernetes command injection — versions ≤2.4.9, unsanitized input reaches execSync in the kubectl_scale, kubectl_patch, and explain_resource tools. CVSS 7.5.

node-code-sandbox-mcp — versions ≤1.2.0 bypass Docker sandbox isolation via unsanitized execSync, exploitable through indirect prompt injection during code generation. CVSS 7.5.

Neo4j MCP Cypher server DNS rebinding — versions 0.2.2-0.3.1, bypasses Same-Origin Policy to enable complete database takeover of locally running Neo4j instances. CVSS 7.4.

MCPJam inspector — versions ≤1.4.2, binds 0.0.0.0 with no auth on a critical endpoint; a single crafted HTTP request installs an MCP server and executes code, no user interaction. CVSS 9.8.

mcp-fetch-server SSRF — versions ≤1.0.2, is_ip_private() fails to validate private IPs, reaching internal network services. CVSS 9.3.

flowchart TD
    A[Attacker commits benign MCP config to shared repo] --> B[User approves config]
    B --> C[Attacker swaps config for malicious payload]
    C --> D[Cursor trusts prior approval, no re-check]
    D --> E[Persistent RCE]

Preconditions / Affected

Each item above requires its stated version range and configuration (e.g., default 0.0.0.0 binding for MCPJam/Grafana, shared-repo write access for the Cursor trust bypass, Docker-sandboxed code execution paths for node-code-sandbox-mcp).

What to do

The page gives version ceilings as the actionable guidance rather than explicit remediation steps: upgrade past mcp-remote 0.1.15, mcp-server-kubernetes 2.4.9, node-code-sandbox-mcp 1.2.0, MCPJam inspector 1.4.2, mcp-fetch-server 1.0.2, Neo4j MCP Cypher server 0.3.1, and Cursor 1.2.4. No further patch commands or config snippets are given in the text.

Caveats

The page states CVSS figures and version boundaries as flat facts with no reproduction steps, PoCs, or disclosure dates — treat the ranges as the ceiling for patched vs. vulnerable, not as verified by this page's own testing.