CVE-2025-10619: @sequa-ai/sequa-mcp has Command Injection vulnerability

The security vulnerability is a classic command injection flaw located in the redirectToAuthorization method of the NodeOauthClientProvider class. The root cause is the improper use of the open library, which is capable of executing shell commands in addition to opening URLs. The original code passed the authorizationUrl parameter, which can be controlled by a remote user, directly to the open function without any validation. This allows an attacker to submit a crafted string that is not a URL but a valid shell command, which the open library then executes. The provided patch confirms this analysis by introducing a check that explicitly validates the authorizationUrl to ensure it is a web URL (starts with 'http://' or 'https://') before it is passed to the open function. This remediation prevents the command injection vector by restricting the function's behavior to its intended purpose of opening web pages.