5.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-9262

CVE-2025-9262: wong2 mcp-cli Command Injection Vulnerability

A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been published and may be used.

This issue has been patched via commit 3562966.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-9262

CVE-2025-9262:

5.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@wong2/mcp-cli	npm	<= 1.13.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the redirectToAuthorization function within the src/oauth/provider.js file of the wong2/mcp-cli package. The core of the issue is a command injection flaw, identified as CWE-77. The vulnerability arises because the function passes an unsanitized authorizationUrl to the open library, which can be manipulated by a remote attacker to execute arbitrary commands on the host system.

The provided patch, commit 35629664cc5d3aea4c3d083d075fe26e7c346b59, clearly shows the remediation. The developers have introduced a call to sanitizeUrl from the strict-url-sanitise library to process the authorizationUrl before it is passed to the open function. This sanitization step ensures that any malicious characters or command sequences are removed, mitigating the command injection risk.

Based on this evidence, the McpOAuthClientProvider.redirectToAuthorization function is the precise location of the vulnerability. Any runtime profile or stack trace generated during the exploitation of this vulnerability would show this function being called as it is the entry point for the malicious input.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.