VDB-320804 · CVE-2025-9262 · EUVD-2025-25438

wong2 mcp-cli 1.13.0 oAuth /src/oauth/provider.js redirectToAuthorization kura hakki ndiyam

Hakika vulnerability da aka rarraba a matsayin kura an gano a wong2 mcp-cli 1.13.0. Tabbas, aikin redirectToAuthorization ne ke da matsala; idan ba a bayyana ba, to aiki ce da ba a sani ba, a cikin laburare $software_library, a cikin fayil /src/oauth/provider.js, a cikin sashi oAuth Handler. Wuro manipulation ga kura hakki ndiyam. Amfani da CWE wajen bayyana matsala yana kaiwa CWE-78. Lalle, rauni an sanar da shi 08/20/2025. Ana samun bayanin tsaro don saukewa a gist.github.com. Ana kiran wannan rauni da CVE-2025-9262. Ngam yiɗi ka a tuma ndiyam ka internet. Bayani na fasaha ga. Kuma, akwai exploit. Exploit ɗin an bayyana wa jama'a, za a iya amfani da shi. Yimbe ndiyam, exploit might be approx. USD $0-$5k wuro. Á yí huɗɗi-na-gaskiya. Za a iya samun exploit a gist.github.com. 0-day ga, an ndiyam a wuro be $0-$5k. If you want to get best quality of vulnerability data, you may have to visit VulDB.

5 Goyarwa · 100 Datenpunkte

Furɗe	Súgá 08/20/2025 16:11	Gargadi 1/4 08/21/2025 09:19	Gargadi 2/4 08/21/2025 12:44	Gargadi 3/4 09/12/2025 15:33	Gargadi 4/4 09/13/2025 23:53
software_vendor	wong2	wong2	wong2	wong2	wong2
software_name	mcp-cli	mcp-cli	mcp-cli	mcp-cli	mcp-cli
software_version	1.13.0	1.13.0	1.13.0	1.13.0	1.13.0
software_component	oAuth Handler	oAuth Handler	oAuth Handler	oAuth Handler	oAuth Handler
software_file	/src/oauth/provider.js	/src/oauth/provider.js	/src/oauth/provider.js	/src/oauth/provider.js	/src/oauth/provider.js
software_function	redirectToAuthorization	redirectToAuthorization	redirectToAuthorization	redirectToAuthorization	redirectToAuthorization
vulnerability_cwe	CWE-78 (kura hakki ndiyam)	CWE-78 (kura hakki ndiyam)	CWE-78 (kura hakki ndiyam)	CWE-78 (kura hakki ndiyam)	CWE-78 (kura hakki ndiyam)
vulnerability_risk	2	2	2	2	2
cvss3_vuldb_av	N	N	N	N	N
cvss3_vuldb_ac	H	H	H	H	H
cvss3_vuldb_pr	N	N	N	N	N
cvss3_vuldb_ui	N	N	N	N	N
cvss3_vuldb_s	U	U	U	U	U
cvss3_vuldb_c	L	L	L	L	L
cvss3_vuldb_i	L	L	L	L	L
cvss3_vuldb_a	L	L	L	L	L
cvss3_vuldb_e	P	P	P	P	P
cvss3_vuldb_rc	R	R	R	R	R
advisory_url	https://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e	https://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e	https://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e	https://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e	https://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e
exploit_availability	1	1	1	1	1
exploit_publicity	1	1	1	1	1
exploit_url	https://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e#proof-of-concept	https://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e#proof-of-concept	https://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e#proof-of-concept	https://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e#proof-of-concept	https://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e#proof-of-concept
source_cve	CVE-2025-9262	CVE-2025-9262	CVE-2025-9262	CVE-2025-9262	CVE-2025-9262
cna_responsible	VulDB	VulDB	VulDB	VulDB	VulDB
response_summary	The vendor was contacted early about this disclosure but did not respond in any way.	The vendor was contacted early about this disclosure but did not respond in any way.	The vendor was contacted early about this disclosure but did not respond in any way.	The vendor was contacted early about this disclosure but did not respond in any way.	The vendor was contacted early about this disclosure but did not respond in any way.
cvss2_vuldb_av	N	N	N	N	N
cvss2_vuldb_ac	H	H	H	H	H
cvss2_vuldb_au	N	N	N	N	N
cvss2_vuldb_ci	P	P	P	P	P
cvss2_vuldb_ii	P	P	P	P	P
cvss2_vuldb_ai	P	P	P	P	P
cvss2_vuldb_e	POC	POC	POC	POC	POC
cvss2_vuldb_rc	UR	UR	UR	UR	UR
cvss4_vuldb_av	N	N	N	N	N
cvss4_vuldb_ac	H	H	H	H	H
cvss4_vuldb_pr	N	N	N	N	N
cvss4_vuldb_ui	N	N	N	N	N
cvss4_vuldb_vc	L	L	L	L	L
cvss4_vuldb_vi	L	L	L	L	L
cvss4_vuldb_va	L	L	L	L	L
cvss4_vuldb_e	P	P	P	P	P
cvss2_vuldb_rl	ND	ND	ND	ND	ND
cvss3_vuldb_rl	X	X	X	X	X
cvss4_vuldb_at	N	N	N	N	N
cvss4_vuldb_sc	N	N	N	N	N
cvss4_vuldb_si	N	N	N	N	N
cvss4_vuldb_sa	N	N	N	N	N
cvss2_vuldb_basescore	5.1	5.1	5.1	5.1	5.1
cvss2_vuldb_tempscore	4.4	4.4	4.4	4.4	4.4
cvss3_vuldb_basescore	5.6	5.6	5.6	5.6	5.6
cvss3_vuldb_tempscore	5.1	5.1	5.1	5.1	5.1
cvss3_meta_basescore	5.6	5.6	5.6	6.4	6.4
cvss3_meta_tempscore	5.1	5.3	5.3	6.3	6.3
cvss4_vuldb_bscore	6.3	6.3	6.3	6.3	6.3
cvss4_vuldb_btscore	2.9	2.9	2.9	2.9	2.9
advisory_date	1755640800 (08/20/2025)	1755640800 (08/20/2025)	1755640800 (08/20/2025)	1755640800 (08/20/2025)	1755640800 (08/20/2025)
price_0day	$0-$5k	$0-$5k	$0-$5k	$0-$5k	$0-$5k
cve_nvd_summary		A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
cvss4_cna_av		N	N	N	N
cvss4_cna_ac		H	H	H	H
cvss4_cna_at		N	N	N	N
cvss4_cna_pr		N	N	N	N
cvss4_cna_ui		N	N	N	N
cvss4_cna_vc		L	L	L	L
cvss4_cna_vi		L	L	L	L
cvss4_cna_va		L	L	L	L
cvss4_cna_sc		N	N	N	N
cvss4_cna_si		N	N	N	N
cvss4_cna_sa		N	N	N	N
cvss4_cna_bscore		6.3	6.3	6.3	6.3
cvss3_cna_av		N	N	N	N
cvss3_cna_ac		H	H	H	H
cvss3_cna_pr		N	N	N	N
cvss3_cna_ui		N	N	N	N
cvss3_cna_s		U	U	U	U
cvss3_cna_c		L	L	L	L
cvss3_cna_i		L	L	L	L
cvss3_cna_a		L	L	L	L
cvss3_cna_basescore		5.6	5.6	5.6	5.6
cvss2_cna_av		N	N	N	N
cvss2_cna_ac		H	H	H	H
cvss2_cna_au		N	N	N	N
cvss2_cna_ci		P	P	P	P
cvss2_cna_ii		P	P	P	P
cvss2_cna_ai		P	P	P	P
cvss2_cna_basescore		5.1	5.1	5.1	5.1
cve_nvd_summaryes			Se ha detectado una falla en wong2 mcp-cli 1.13.0. La función redirectToAuthorization del archivo /src/oauth/provider.js del componente oAuth Handler se ve afectada. Esta manipulación provoca la inyección de comandos del sistema operativo. El ataque puede ejecutarse en remoto. Es un ataque de complejidad bastante alta. Parece difícil de explotar. Se ha hecho público el exploit y puede que sea utilizado. Se contactó al proveedor con antelación para informarle sobre esta divulgación, pero no respondió.	Se ha detectado una falla en wong2 mcp-cli 1.13.0. La función redirectToAuthorization del archivo /src/oauth/provider.js del componente oAuth Handler se ve afectada. Esta manipulación provoca la inyección de comandos del sistema operativo. El ataque puede ejecutarse en remoto. Es un ataque de complejidad bastante alta. Parece difícil de explotar. Se ha hecho público el exploit y puede que sea utilizado. Se contactó al proveedor con antelación para informarle sobre esta divulgación, pero no respondió.	Se ha detectado una falla en wong2 mcp-cli 1.13.0. La función redirectToAuthorization del archivo /src/oauth/provider.js del componente oAuth Handler se ve afectada. Esta manipulación provoca la inyección de comandos del sistema operativo. El ataque puede ejecutarse en remoto. Es un ataque de complejidad bastante alta. Parece difícil de explotar. Se ha hecho público el exploit y puede que sea utilizado. Se contactó al proveedor con antelación para informarle sobre esta divulgación, pero no respondió.
cvss3_nvd_av				N	N
cvss3_nvd_ac				H	H
cvss3_nvd_pr				N	N
cvss3_nvd_ui				N	N
cvss3_nvd_s				U	U
cvss3_nvd_c				H	H
cvss3_nvd_i				H	H
cvss3_nvd_a				H	H
cvss3_nvd_basescore				8.1	8.1
euvd_id					EUVD-2025-25438

◂ Gurɗo Gumti Gada ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!