The official @modelcontextprotocol/inspector debugging tool read transport, serverCommand and serverArgs from its own /oauth/callback URL. A hostile MCP server could send the browser back through OAuth with transport=stdio&serverCommand=... added, and after the token exchange Inspector reconnected over stdio and ran that command on the developer's machine, on any OS, just by connecting. Affected 0.13.0 through 1.0.2 (inspector and inspector-client); fixed in 1.0.3. Corgea's write-up says the maintainers published six advisories on Oct 21, including GHSA-q978-78c7-phqw (CVSS 8.8, a Windows/WSL PowerShell injection through the open package, the same bug class as the OpenCode sign-in flaw), and that the v2 line is fixed in 2.12.0. Upgrade, and don't point Inspector at MCP servers you haven't vetted.