diillson github.com/diillson/chatcli vulnerabilities

Latest diillson github.com/diillson/chatcli CVEs

Newest publication first

1. CVE-2026-123271 ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator

   Published 2026-11-05

   Medium·CVSS 5.1 EPSS 0.15%

   ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can declare another reso...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.