Skip to content
OpenAdvisories
Critical · 9.8 Scanner template Public exploit CVE-2026-23744 EUVD-2026-2859GHSA-232v-j27c-5pp6

REC in MCPJam inspector due to HTTP Endpoint exposes

Published Jan 16, 2026 · Updated Jan 16, 2026 · Assigned by GitHub_M

Vendor: MCPJam Product: inspector Package: @mcpjam/inspector Ecosystem: npm

Description

MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Since MCPJam inspector by default listens on 0.0.0.0 instead of 127.0.0.1, an attacker can trigger the RCE remotely via a simple HTTP request. Version 1.4.3 contains a patch.

Affected products

VendorProductAffectedFixed
MCPJam inspector <= 1.4.2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Exploit-DB 1

GitHub 39 repositories · most starred shown

  • suljov/CVE-2026-23744-Remote-Code-Execution-POC ★ 12 · Mar 21, 2026

    MCPJam inspector contains a remote code execution

  • boroeurnprach/CVE-2026-23744-PoC ★ 12 · Jan 20, 2026

    CVE-2026-23744 - Versions 1.4.2 and earlier of MCPJam inspector are vulnerable to remote code execution (RCE). Because the tool listens on 0.0.0.0 by default, an attacker can trigger the installation…

  • CerberusMrXi/CVE-2026-23744-MCPJam-Exploit ★ 7 · Jul 14, 2026

    A proof-of-concept exploit for CVE-2026-23744 - MCPJam Inspector Remote Code Execution (RCE) vulnerability. This tool demonstrates the security flaw in versions <=1.4.2 and helps security researchers…

  • luiskrnr/exploit-CVE-2026-23744 ★ 4 · Apr 10, 2026

    MCPJam Inspector is a local-first development platform for MCP servers. In versions 1.4.2 (and earlier), a RCE flaw lets attackers send crafted HTTP request that installs an MCP server and runs code …

  • FrenzisRed/CVE-2026-23744 ★ 4 · Mar 23, 2026

    CVE-2026-23744 - MCPJam inspector Remote-Code-Execution: Proof Of Concept (POC

  • Mluex0/CVE-2026-23744-PoC ★ 2 · Aug 10, 2026

    CVE-2026-23744 is an unauthenticated command injection in MCPJam Inspector ≤1.4.2 via /api/mcp/connect. This POC exploits it by sending a crafted JSON payload to execute arbitrary commands, granting …

  • SrGinebras/CVE-2026-23744-RCE-for-MCPjam-inspector-v1.4.2 ★ 1 · May 31, 2026
  • 0xg00se/CVE-2026-23744-script ★ 1 · Mar 27, 2026

    Exploit script for CVE-2026-23744

  • ctzisme/CVE-2026-23744 ★ 1 · Mar 26, 2026

    PoC for CVE-2026-23744, demonstrating an unauthenticated RCE in MCPJam Inspector (<= 1.4.2).

  • InzegoSec/CVE-2026-23744 ★ 1 · Mar 24, 2026

    Exploit to MCPJam Inspector <=1.4.2

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

EcosystemPackageAffectedFixedRecord
npm @mcpjam/inspector < 1.4.3 1.4.3 GHSA-232v-j27c-5pp6

References