[Security] Fix potential command injection on Windows in CLI dev command

Author: RinZ27

GEMINI_BRIEFING.md

@@ -0,0 +1,56 @@
+# 🤖 GEMINI INTELLIGENCE BRIEFING
+## 1. ARCHITECTURE
+**System Insight**
+
+This repository, the MCP Python SDK, is a technical implementation of the Model Context Protocol (MCP). The core purpose of this project is to provide a standardized interface for interacting with models and contexts in a flexible and extensible way. The system's DNA reveals a strong focus on modularity, with clear separation between entry points (`EntryPoints`), core functionality (`CoreZone`), and dependencies.
+
+The technical philosophy behind the MCP Python SDK appears to prioritize:
+
+1. **Modularity**: Clear separation of concerns between different components, making it easier to maintain and extend.
+2. **Flexibility**: The use of standardized interfaces (e.g., TOML, YAML, JSON) allows for easy integration with various tools and frameworks.
+3. **Extensibility**: The project's structure and documentation suggest a willingness to accommodate new features and use cases.
+
+The data flow within the system is likely centered around the `mcp` module, which serves as the core functionality of the SDK. This module would interact with external dependencies (e.g., databases, file systems) through standardized interfaces, allowing for seamless integration with various tools and frameworks.
+
+Overall, the MCP Python SDK appears to be designed with scalability, flexibility, and extensibility in mind, making it an attractive choice for developers working with models and contexts.
+## 2. TOP THREATS
+Based on the analysis of the findings provided, here is a structured summary focusing on the critical logic and security issues affecting the 'CoreZone' or 'EntryPoints':
+
+### Critical Issues Identified:
+
+1. **TRIVY Critical Vulnerabilities in mcp (1.3.0.dev0):**
+   - **CVE-2025-43859, CVE-2025-53365, CVE-2025-53366, and CVE-2025-66416** present significant security risks. These vulnerabilities could allow attackers to exploit the system if `mcp` is part of the CoreZone or EntryPoints.
+
+2. **TRIVY High Vulnerability in starlette (0.27.0):**
+   - **CVE-2024-47874** indicates a high severity security flaw that could impact the system's integrity if `starlette` is used within the CoreZone or EntryPoints.
+
+3. **SEMGREP Warning and Error in importlib.import_module() and subprocess.run():**
+   - While these issues primarily affect user input handling, they are critical if they influence the CoreZone functionality directly. If `mcp` relies on dynamic imports or shell commands, these could pose risks to the CoreZone.
+
+### Conclusion:
+All TRIVY findings (h11, mcp, starlette) should be considered as they relate to dependencies that could affect the system's security when loaded during runtime. The SEMGREP issues are more about user input handling but may impact the CoreZone if used within core functionalities. 
+
+**Final List of Critical Issues:**
+
+- **mcp (1.3.0.dev0)** with multiple high severity vulnerabilities.
+- **starlette (0.27.0)** with a high severity vulnerability.
+
+These issues require immediate attention to ensure system security and robustness.
+## 3. CONTEXT
+### 1. TRIVY Critical Vulnerabilities in mcp (1.3.0.dev0)
+
+**So What?**  
+If the `mcp` library, which is part of the CoreZone or EntryPoints, contains critical vulnerabilities like CVE-2025-43859, CVE-2025-53365, CVE-2025-53366, and CVE-2025-66416, it could be exploited by attackers. This would compromise the security of your system, potentially leading to data breaches, unauthorized access, or even complete system takeover.
+
+### 2. TRIVY High Vulnerability in starlette (0.27.0)
+
+**So What?**  
+The `starlette` library, which is also part of the CoreZone or EntryPoints, has a high severity vulnerability (CVE-2024-47874). If this vulnerability is exploited, it could impact the integrity and stability of your system. This could result in data corruption, denial of service, or other critical issues that affect the overall functionality of your project.
+
+### 3. SEMGREP Warning and Error in importlib.import_module() and subprocess.run()
+
+**So What?**  
+While these SEMGREP warnings and errors primarily relate to user input handling, they could pose risks if `mcp` relies on dynamic imports or shell commands. If an attacker can manipulate the inputs to `importlib.import_module()` or `subprocess.run()`, it could lead to the execution of arbitrary code or malicious commands. This could compromise the security and stability of your system, potentially leading to data loss, unauthorized access, or other critical issues.
+## 4. RAW STATS
+Themes: QUANTUM WEB3 AI_ML 
+Hotspots: /Users/dangnhatrin/python-sdk/src/mcp/cli/cli.py

src/mcp/cli/cli.py

@@ -3,6 +3,7 @@
 import importlib.metadata
 import importlib.util
 import os
+import shlex
 import subprocess
 import sys
 from pathlib import Path
@@ -275,8 +276,15 @@ def dev(
 
         # Run the MCP Inspector command with shell=True on Windows
         shell = sys.platform == "win32"
+        cmd_args = [npx_cmd, "@modelcontextprotocol/inspector"] + uv_cmd
+
+        if shell:
+            # On Windows with shell=True, we need to quote arguments to prevent injection
+            # and join them into a single string, as passing a list with shell=True is unsafe/undefined behavior
+            cmd_args = " ".join(shlex.quote(arg) for arg in cmd_args)
+
         process = subprocess.run(
-            [npx_cmd, "@modelcontextprotocol/inspector"] + uv_cmd,
+            cmd_args,
             check=True,
             shell=shell,
             env=dict(os.environ.items()),  # Convert to list of tuples for env update