wong2 mcp-cli oAuth provider.js redirectToAuthorization os command injection

published 2025-08-20 14 mo ago modified 2026-06-17 4 mo ago also GHSA-p6rm-483j-37jf , EUVD-2025-25438

cvss: 5.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 4.3%; EPSS 4.3% chance of exploitation in 30 days, percentile 91%
public exploits: 0; none known

A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Patch / fix

links 2

github.com/wong2/mcp-cli@3562966 commit
github.com/wong2/mcp-cli#16 pull request

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 14 mo ago (2025-08-21)

Exploit prediction

4.29% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

gist.github.com https://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e referenced PoC, tagged "exploit" by a source, unverified
gist.github.com https://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e#proof-of-concept referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.3	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CNA	3.1	5.6	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CNA	3.0	5.6	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CNA	2.0	5.1	AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
CNA	4.0	2.9	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	5.6	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD	3.1	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	2.0	5.1	AV:N/AC:H/Au:N/C:P/I:P/A:P
GitHub	3.1	5.6	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem	package	affected	fixed in
npm	@wong2/mcp-cli	<=1.13.0	no fix listed

Affected products

wong2 mcp-cli

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command
CWE-77 Improper Neutralization of Special Elements used in a Command

References

github.com /wong2/mcp-cli/pull/16
web
github.com /wong2/mcp-cli/commit/35629664cc5d3aea4c3d083d075fe26e7c346b59
web
gist.github.com /superboy-zjc/a01bd059c4078249d899f8c70c8feb0e
related, exploit, web, third-party-advisory
gist.github.com /superboy-zjc/a01bd059c4078249d899f8c70c8feb0e#proof-of-concept
exploit, web, third-party-advisory
vuldb.com /?id.320804
vdb-entry, technical-description, web, third-party-advisory
vuldb.com /?ctiid.320804
signature, permissions-required, web, vdb-entry
vuldb.com /?submit.631697
third-party-advisory, web, vdb-entry
nvd.nist.gov /vuln/detail/CVE-2025-9262
advisory
github.com /wong2/mcp-cli
package

Sources

CVE List CVE-2025-9262
GitHub Advisory GHSA-p6rm-483j-37jf
NVD CVE-2025-9262

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary