wong2 mcp-cli 1.13.0 oAuth /src/oauth/provider.js redirectToAuthorization ବିସ୍ତାରିତ ଅଧିକାର

Dogoggorri kan akka ଜଟିଳ jedhamuun ramadame wong2 mcp-cli 1.13.0 keessatti argameera. Miidhamni argame is hojii redirectToAuthorization faayilii /src/oauth/provider.js keessa kutaa oAuth Handler keessa. Wanti jijjiirame gara ବିସ୍ତାରିତ ଅଧିକାର geessa. Rakkoo ibsuuf CWE yoo fayyadamte gara CWE-78 si geessa. Odeeffannoon kun yeroo 08/20/2025 maxxanfameera. Odeeffannoon kun buufachuuf gist.github.com irratti argama. Dogoggorri kun CVE-2025-9262 jedhamee waamama. Weerara fageenya irraa jalqabuu ni danda'ama. Ibsa teeknikaa ni jira. Waan dabalataa ta’een, meeshaa balaa kana fayyadamuuf ni jira. Qorannoo miidhaa (exploit) uummataaf ifa taasifameera, kanaafis fayyadamuu ni danda'ama. Ammas, gatii exploit might be approx. USD $0-$5k yeroo ammaa irratti argamuu danda'a. ପ୍ରୁଫ୍-ଅଫ୍-କନ୍ସେପ୍ଟ ta’uu isaa ibsameera. Exploit gist.github.com irraa buufachuun ni danda'ama. Akka 0-daytti, gatiin isaa daldala dhoksaa keessatti $0-$5k akka ta'e tilmaamameera. If you want to get best quality of vulnerability data, you may have to visit VulDB.

5 ଆଡାପ୍ଟେସନ୍ · 100 ପଏଣ୍ଟ

ଫିଲ୍ଡସୃଷ୍ଟି ହୋଇଛି
08/20/2025 04:11 PM		ଅଦ୍ୟତନ 1/4
08/21/2025 09:19 AM		ଅଦ୍ୟତନ 2/4
08/21/2025 12:44 PM		ଅଦ୍ୟତନ 3/4
09/12/2025 03:33 PM		ଅଦ୍ୟତନ 4/4
09/13/2025 11:53 PM
software_vendorwong2wong2wong2wong2wong2
software_namemcp-climcp-climcp-climcp-climcp-cli
software_version1.13.01.13.01.13.01.13.01.13.0
software_componentoAuth HandleroAuth HandleroAuth HandleroAuth HandleroAuth Handler
software_file/src/oauth/provider.js/src/oauth/provider.js/src/oauth/provider.js/src/oauth/provider.js/src/oauth/provider.js
software_functionredirectToAuthorizationredirectToAuthorizationredirectToAuthorizationredirectToAuthorizationredirectToAuthorization
vulnerability_cweCWE-78 (ବିସ୍ତାରିତ ଅଧିକାର)CWE-78 (ବିସ୍ତାରିତ ଅଧିକାର)CWE-78 (ବିସ୍ତାରିତ ଅଧିକାର)CWE-78 (ବିସ୍ତାରିତ ଅଧିକାର)CWE-78 (ବିସ୍ତାରିତ ଅଧିକାର)
vulnerability_risk22222
cvss3_vuldb_avNNNNN
cvss3_vuldb_acHHHHH
cvss3_vuldb_prNNNNN
cvss3_vuldb_uiNNNNN
cvss3_vuldb_sUUUUU
cvss3_vuldb_cLLLLL
cvss3_vuldb_iLLLLL
cvss3_vuldb_aLLLLL
cvss3_vuldb_ePPPPP
cvss3_vuldb_rcRRRRR
advisory_urlhttps://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0ehttps://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0ehttps://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0ehttps://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0ehttps://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e
exploit_availability11111
exploit_publicity11111
exploit_urlhttps://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e#proof-of-concepthttps://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e#proof-of-concepthttps://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e#proof-of-concepthttps://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e#proof-of-concepthttps://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e#proof-of-concept
source_cveCVE-2025-9262CVE-2025-9262CVE-2025-9262CVE-2025-9262CVE-2025-9262
cna_responsibleVulDBVulDBVulDBVulDBVulDB
response_summaryThe vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.
cvss2_vuldb_avNNNNN
cvss2_vuldb_acHHHHH
cvss2_vuldb_auNNNNN
cvss2_vuldb_ciPPPPP
cvss2_vuldb_iiPPPPP
cvss2_vuldb_aiPPPPP
cvss2_vuldb_ePOCPOCPOCPOCPOC
cvss2_vuldb_rcURURURURUR
cvss4_vuldb_avNNNNN
cvss4_vuldb_acHHHHH
cvss4_vuldb_prNNNNN
cvss4_vuldb_uiNNNNN
cvss4_vuldb_vcLLLLL
cvss4_vuldb_viLLLLL
cvss4_vuldb_vaLLLLL
cvss4_vuldb_ePPPPP
cvss2_vuldb_rlNDNDNDNDND
cvss3_vuldb_rlXXXXX
cvss4_vuldb_atNNNNN
cvss4_vuldb_scNNNNN
cvss4_vuldb_siNNNNN
cvss4_vuldb_saNNNNN
cvss2_vuldb_basescore5.15.15.15.15.1
cvss2_vuldb_tempscore4.44.44.44.44.4
cvss3_vuldb_basescore5.65.65.65.65.6
cvss3_vuldb_tempscore5.15.15.15.15.1
cvss3_meta_basescore5.65.65.66.46.4
cvss3_meta_tempscore5.15.35.36.36.3
cvss4_vuldb_bscore6.36.36.36.36.3
cvss4_vuldb_btscore2.92.92.92.92.9
advisory_date1755640800 (08/20/2025)1755640800 (08/20/2025)1755640800 (08/20/2025)1755640800 (08/20/2025)1755640800 (08/20/2025)
price_0day$0-$5k$0-$5k$0-$5k$0-$5k$0-$5k
cve_nvd_summaryA flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
cvss4_cna_avNNNN
cvss4_cna_acHHHH
cvss4_cna_atNNNN
cvss4_cna_prNNNN
cvss4_cna_uiNNNN
cvss4_cna_vcLLLL
cvss4_cna_viLLLL
cvss4_cna_vaLLLL
cvss4_cna_scNNNN
cvss4_cna_siNNNN
cvss4_cna_saNNNN
cvss4_cna_bscore6.36.36.36.3
cvss3_cna_avNNNN
cvss3_cna_acHHHH
cvss3_cna_prNNNN
cvss3_cna_uiNNNN
cvss3_cna_sUUUU
cvss3_cna_cLLLL
cvss3_cna_iLLLL
cvss3_cna_aLLLL
cvss3_cna_basescore5.65.65.65.6
cvss2_cna_avNNNN
cvss2_cna_acHHHH
cvss2_cna_auNNNN
cvss2_cna_ciPPPP
cvss2_cna_iiPPPP
cvss2_cna_aiPPPP
cvss2_cna_basescore5.15.15.15.1
cve_nvd_summaryesSe ha detectado una falla en wong2 mcp-cli 1.13.0. La función redirectToAuthorization del archivo /src/oauth/provider.js del componente oAuth Handler se ve afectada. Esta manipulación provoca la inyección de comandos del sistema operativo. El ataque puede ejecutarse en remoto. Es un ataque de complejidad bastante alta. Parece difícil de explotar. Se ha hecho público el exploit y puede que sea utilizado. Se contactó al proveedor con antelación para informarle sobre esta divulgación, pero no respondió.Se ha detectado una falla en wong2 mcp-cli 1.13.0. La función redirectToAuthorization del archivo /src/oauth/provider.js del componente oAuth Handler se ve afectada. Esta manipulación provoca la inyección de comandos del sistema operativo. El ataque puede ejecutarse en remoto. Es un ataque de complejidad bastante alta. Parece difícil de explotar. Se ha hecho público el exploit y puede que sea utilizado. Se contactó al proveedor con antelación para informarle sobre esta divulgación, pero no respondió.Se ha detectado una falla en wong2 mcp-cli 1.13.0. La función redirectToAuthorization del archivo /src/oauth/provider.js del componente oAuth Handler se ve afectada. Esta manipulación provoca la inyección de comandos del sistema operativo. El ataque puede ejecutarse en remoto. Es un ataque de complejidad bastante alta. Parece difícil de explotar. Se ha hecho público el exploit y puede que sea utilizado. Se contactó al proveedor con antelación para informarle sobre esta divulgación, pero no respondió.
cvss3_nvd_avNN
cvss3_nvd_acHH
cvss3_nvd_prNN
cvss3_nvd_uiNN
cvss3_nvd_sUU
cvss3_nvd_cHH
cvss3_nvd_iHH
cvss3_nvd_aHH
cvss3_nvd_basescore8.18.1
euvd_idEUVD-2025-25438

◂ ପଛକୁସମୀକ୍ଷାଆହୁରି ଦୂରରେ ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!