The report
An MCP Inspector client may discover a remote server's OAuth authorization endpoint while setting up a connection. In affected Windows and Windows Subsystem for Linux paths, the client placed that remotely supplied URL inside a PowerShell double-quoted string. PowerShell expands subexpressions within such strings, meaning the command could execute attacker-chosen local actions before any model used an MCP tool.
The project advisory lists affected Inspector releases from 2.0.0 through 2.11.0 and version 2.12.0 as patched. The attack requires connecting to a malicious or attacker-controlled MCP service that can influence the OAuth discovery response. It is not an unconditional exploit of every Inspector installation, and the advisory does not identify a confirmed victim campaign.
A browser authorization URL became a shell argument
The intended operation was to open a login page. The realized risk came from treating untrusted configuration data as a string that the local shell would interpret. Sanitizing a model's prompt cannot repair that boundary, because the source text reaches an operating-system interpreter without a model decision. Using an argument-safe process launch or a dedicated URL opener removes the relevant expression expansion. The Case preserves the Windows-specific condition and the version boundary.