MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command Execution

`@modelcontextprotocol/inspector` and `inspector-client` 0.13.0 through 1.0.2 and the 2.x line before 2.12.0, the official MCP developer debugging tool

Nine advisories were published on October 21, 2026, none with a CVE. GHSA-4fc4-wcmh-4g86 (CVSS 9.6): a malicious server's OAuth challenge sends the user to an attacker authorization server, which redirects to Inspector's `/oauth/callback` with appended `transport=stdio`, `serverCommand`, and `serverArgs`; after the token exchange Inspector reconnects with those values and the local proxy runs the attacker's command. GHSA-6x67-4w4w-9f3w (CVSS 9.6): a remote MCP App could steal the proxy auth token and run local commands. GHSA-q978-78c7-phqw (8.8): a remote server's OAuth authorization URL ran PowerShell subexpressions on Windows and WSL. GHSA-vcc9-3xgm-p9v4: an incomplete fix for CVE-2025-49596 left DNS rebinding able to expose the API token and stored OAuth tokens. Others leaked the session token to a query-chosen origin and forwarded Authorization and Cookie headers across cross-origin redirects. Fixed in 1.0.3 and 2.12.0

The OAuth callback trusted every query parameter instead of only OAuth fields, and the local proxy that can spawn processes was reachable with tokens a remote server could obtain