PT-2025-38278 · Sequa Ai+1 · Sequa-Ai+1

Yhryhryhr · CVE-2025-10619 · Published 2025-09-17 · Updated 2025-09-18

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions sequa-ai sequa-mcp versions prior to 1.0.14

Description A vulnerability exists in the redirectToAuthorization function within the OAuth Server Discovery component, specifically in the file src/helpers/node-oauth-client-provider.ts. Manipulation of the system can lead to operating system command injection. Remote exploitation is possible.

Recommendations Upgrade to version 1.0.14 or later.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2025-10619

GHSA-9PW5-WX67-Q964

Affected Products

Sequa-Ai

Sequa-Mcp

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10619.json · Exploit
• 🔥 https://lavender-bicycle-a5a.notion.site/Sequa-MCP-RCE-26853a41781f807da1c0cd158f9e3e1a · Exploit
• 🔥 https://lavender-bicycle-a5a.notion.site/Sequa-MCP-RCE-26853a41781f807da1c0cd158f9e3e1a?source=copy_link · Exploit
• https://github.com/sequa-ai/sequa-mcp/commit/e569815854166db5f71c2e722408f8957fb9e804 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-10619 · Security Note
• https://osv.dev/vulnerability/GHSA-9pw5-wx67-q964 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-10619 · Vendor Advisory
• https://github.com/sequa-ai/sequa-mcp · Note
• https://twitter.com/CVEnew/status/1968561169074921688 · Twitter Post
• https://vuldb.com/?id.324646 · Note
• https://vuldb.com/?ctiid.324646 · Note
• https://vuldb.com/?submit.650189 · Note
• https://github.com/advisories/GHSA-9pw5-wx67-q964 · Note
• https://npmjs.com/package/%40sequa-ai/sequa-mcp/v/1.0.14 · Note