---
title: MCP Inspector: a malicious remote MCP server can turn the OAuth callback into a local command launch (GHSA-4fc4-wcmh-4g86, CVSS 9.6) | ctxsec
url: https://ctxsec.com/items/mcp-inspector-oauth-callback-stdio-rce
description: ""
status: "confirmed (GitHub advisory GHSA-4fc4-wcmh-4g86, Oct 21)"
published: 2026-10-21
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/mcp-inspector-oauth-callback-stdio-rce.md)

confirmed (GitHub advisory GHSA-4fc4-wcmh-4g86, Oct 21)

2026-10-21

### MCP Inspector: a malicious remote MCP server can turn the OAuth callback into a local command launch (GHSA-4fc4-wcmh-4g86, CVSS 9.6)

The official `@modelcontextprotocol/inspector` debugging tool read `transport`, `serverCommand` and `serverArgs` from its own `/oauth/callback` URL. A hostile MCP server could send the browser back through OAuth with `transport=stdio&serverCommand=...` added, and after the token exchange Inspector reconnected over stdio and ran that command on the developer's machine, on any OS, just by connecting. Affected 0.13.0 through 1.0.2 (inspector and inspector-client); fixed in **1.0.3**. Corgea's write-up says the maintainers published six advisories on Oct 21, including GHSA-q978-78c7-phqw (CVSS 8.8, a Windows/WSL PowerShell injection through the `open` package, the same bug class as the OpenCode sign-in flaw), and that the v2 line is fixed in 2.12.0. Upgrade, and don't point Inspector at MCP servers you haven't vetted.

Sources: [GitHub advisory GHSA-4fc4-wcmh-4g86](https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-4fc4-wcmh-4g86) · [Corgea research write-up](https://corgea.com/research/opencode-mcp-inspector-oauth-url-powershell-rce-october-2026)