MCP Inspector connects to a server that may be unfamiliar or attacker controlled. Its OAuth discovery flow accepted the remote authorization endpoint as configuration and passed it through a command launcher. On Windows and WSL, PowerShell interprets subexpressions inside the surrounding string; the unsafe launch therefore creates a code execution path even…
Inspect the ClaimsCase · DiggingBeagle record
MCP Inspector connected to a malicious OAuth endpoint and executed PowerShell
The MCP Inspector advisory describes a remote server supplying an OAuth authorization URL that entered an unescaped PowerShell double-quoted argument on Windows or WSL, permitting subexpression execution before any model tool call.
Scope
Requires a malicious reachable remote MCP server plus the affected Windows or WSL launch path; not a cross-platform unconditional exploit or a confirmed victim campaign.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The project advisory identifies a PowerShell interpolation path reached from remote OAuth authorization metadata and a fix in 2.12.0. The triggering platform and browser launch path are prerequisites, not every MCP Inspector installation. Impact remains unrated because the evidence does not supply a calibrated scale for this Case.
Assessed Nov 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV01-MCP-INSPECTOR-OAUTH-RCE-1 · MCP Inspector GHSA-q978-78c7-phqw OAuth URL PowerShell injection
At a glance
Assess the reported tool or model action separately from the side effect actually observed.
Read the implicationsRequires a malicious reachable remote MCP server plus the affected Windows or WSL launch path; not a cross-platform unconditional exploit or a confirmed victim campaign.
Limits and uncertaintyFull account
MCP Inspector connects to a server that may be unfamiliar or attacker controlled. Its OAuth discovery flow accepted the remote authorization endpoint as configuration and passed it through a command launcher. On Windows and WSL, PowerShell interprets subexpressions inside the surrounding string; the unsafe launch therefore creates a code execution path even though no language model decides to use a tool. The disclosure identifies a fix in Inspector 2.12.0.
The unsafe instruction reached PowerShell through argument construction for an external authentication URL rather than through model reasoning. A model-only prompt-injection filter would miss this class of problem because the command interpreter, not the model, expands the remote string. The effective boundary is literal argument passing to the host process.
Mechanism and trust boundary
- 01
Step
Claims & evidence
CLM-2026-NOV01-MCP-INSPECTOR-OAUTH-RCE-1The MCP Inspector advisory describes a remote server supplying an OAuth authorization URL that entered an unescaped PowerShell double-quoted argument on Windows or WSL, permitting subexpression execution before any model tool call.supported
Basis: reported finding
- supportsMCP Inspector GHSA-q978-78c7-phqw OAuth URL PowerShell injectionprimary disclosure
GHSA-q978-78c7-phqw, Summary, The attacker input, The sink and version fix 2.12.0
Implications
Assess the reported tool or model action separately from the side effect actually observed.
Controls and mitigations
- Upgrade to Inspector 2.12.0, use process APIs that pass URL arguments literally, and prohibit PowerShell expression evaluation of remote metadata.
Unknowns and contradictions
- Requires a malicious reachable remote MCP server plus the affected Windows or WSL launch path; not a cross-platform unconditional exploit or a confirmed victim campaign.
Sources and citation
Material revision history
- Nov 1, 2026 · Canonical change recorded · new in release · revision 211