A vulnerability was found in wong2 mcp-cli 1.13.0. It has been rated as critical. Affected is the function
redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection.
This vulnerability appears as CVE-2025-9262. The attack may be initiated remotely. In addition, an exploit is available.
The vendor was contacted early about this disclosure but did not respond in any way.
