card-ocr-fastmcp (1.0.0) potentially affected by CVE-2025-9262 via @wong2/mcp-cli (1.13.0)

@wong2/mcp-cli NPM version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on @wong2/mcp-cli and may be impacted: - card-ocr-fastmcp 1.0.0 Source cves: CVE-2025-9262 Source advisory: SNYK:JS-WONG2MCPCLI-12205740...

CVE-2025-9262 wong2 mcp-cli oAuth provider.js redirectToAuthorization os command injection

A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection. The attack may be initiated remotely. The attack is considered to have high complexity...