PT-2025-38278 · Sequa-Mcp+1 · Sequa-Mcp+1

Yhryhryhr · Published 2025-09-17 · Updated 2025-09-18 · CVE-2025-10619

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions sequa-ai sequa-mcp versions prior to 1.0.14

Description A vulnerability exists in the redirectToAuthorization function within the OAuth Server Discovery component, specifically in the file src/helpers/node-oauth-client-provider.ts. Manipulation of the system can lead to operating system command injection. Remote exploitation is possible.

Recommendations Upgrade to version 1.0.14 or later.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2025-10619

GHSA-9PW5-WX67-Q964

Affected Products

Sequa-Ai

Sequa-Mcp

References · 13

• 🔥 https://lavender-bicycle-a5a.notion.site/Sequa-MCP-RCE-26853a41781f807da1c0cd158f9e3e1a?source=copy_link · Exploit
• 🔥 https://lavender-bicycle-a5a.notion.site/Sequa-MCP-RCE-26853a41781f807da1c0cd158f9e3e1a · Exploit
• https://github.com/sequa-ai/sequa-mcp/commit/e569815854166db5f71c2e722408f8957fb9e804 · Patch
• https://osv.dev/vulnerability/GHSA-9pw5-wx67-q964 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10619 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10619 · Vendor Advisory
• https://github.com/sequa-ai/sequa-mcp · Note
• https://github.com/advisories/GHSA-9pw5-wx67-q964 · Note
• https://vuldb.com/?submit.650189 · Note
• https://npmjs.com/package/%40sequa-ai/sequa-mcp/v/1.0.14 · Note
• https://vuldb.com/?ctiid.324646 · Note
• https://vuldb.com/?id.324646 · Note
• https://twitter.com/CVEnew/status/1968561169074921688 · Twitter Post