CVE-2025-9262
Published: 20 August 2025
Summary
CVE-2025-9262 is a medium-severity Command Injection (CWE-77) vulnerability in Wong2 Mcp-Cli. Its CVSS base score is 5.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 34.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote OS command injection (CWE-78) in public-facing OAuth handler directly enables T1190 exploitation and arbitrary command execution via T1059.
NVD Description
A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection. The attack may be initiated remotely. The attack is considered to…
more
have high complexity. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-9262 is an OS command injection vulnerability (CWE-77, CWE-78) in wong2 mcp-cli version 1.13.0. The flaw resides in the redirectToAuthorization function within the file /src/oauth/provider.js of the oAuth Handler component. This issue allows manipulation that triggers OS command injection and was published on 2025-08-20 with a CVSS v3.1 base score of 5.6 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).
The vulnerability enables remote exploitation with high complexity and is rated as difficult to exploit, requiring no privileges or user interaction. Attackers can achieve low-level impacts on confidentiality, integrity, and availability, potentially executing arbitrary OS commands through the OAuth handler.
Advisories from VulDB note that the vendor was contacted early about the disclosure but provided no response, and no patches or mitigations are referenced. A proof-of-concept exploit has been published and is available via linked gists, indicating it may be usable by attackers.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- N/A
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- No AI-related keywords detected.