Evidence · DiggingBeagle record
MCP Inspector GHSA-q978-78c7-phqw OAuth URL PowerShell injection
First-party security advisory for OAuth metadata supplied by a remote MCP server entering a local Windows PowerShell launch.
- Source role
- primary disclosure
Evidence record
First-party security advisory for OAuth metadata supplied by a remote MCP server entering a local Windows PowerShell launch.
Claim-level citations (1)
- supportsMCP Inspector connected to a malicious OAuth endpoint and executed PowerShell: The MCP Inspector advisory describes a remote server supplying an OAuth authorization URL that entered an unescaped PowerShell double-quoted argument on Windows or WSL, permitting subexpression execution before any model tool call.
GHSA-q978-78c7-phqw, Summary, The attacker input, The sink and version fix 2.12.0