DebugMCP has a DNS rebinding RCE vulnerability

Imperva Threat Research disclosed a remote code execution vulnerability in Microsoft DevLabs' DebugMCP 1.1.4, where an attacker can induce a developer to visit a malicious webpage to execute arbitrary code in the background. This MCP server automatically starts on port 3001 after installation with no authentication, does not enable the Host and Origin header validation that Anthropic added in modelcontextprotocol 1.24.0, and can be bypassed for the browser same-origin policy via DNS rebinding; its start_debugging tool accepts a file path parameter, and combined with Windows UNC paths can load and execute scripts from an attacker's SMB share. MCP's stateless session mode allows a single no-cors request to trigger the attack. The maintainer fixed it in commit 86776b2, released with version 1.2.0 and later, with no security advisory published.