CVE-2025-11273: LaChatterie Verger RCE Vulnerability

CVE-2025-11273 Overview

CVE-2025-11273 is an insecure deserialization vulnerability affecting LaChatterie Verger versions up to 1.2.10. The flaw resides in the redirectToAuthorization function within /src/main/services/mcp/oauth/provider.ts. Attackers manipulate the URL argument to trigger unsafe deserialization during the OAuth redirect flow. The issue is classified under [CWE-20] (Improper Input Validation). A public exploit exists, and the vendor did not respond to disclosure attempts. The attack can be executed remotely against a vulnerable client.

Critical Impact
Remote attackers with low privileges can trigger deserialization by supplying a crafted URL to the Model Context Protocol (MCP) OAuth provider, leading to potential code execution in the Verger client context.

Affected Products

LaChatterie Verger versions up to and including 1.2.10
Affected file: /src/main/services/mcp/oauth/provider.ts
Affected function: redirectToAuthorization

Discovery Timeline

2025-10-04 - CVE-2025-11273 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11273

Vulnerability Analysis

The vulnerability affects the Model Context Protocol (MCP) OAuth provider inside the Verger Electron application. The redirectToAuthorization function processes an attacker-influenced URL argument without adequate validation. Instead of treating the parameter as opaque data, the code path deserializes attacker-controlled content. Because Verger is a desktop client that handles remote MCP responses, the deserialization occurs in the main process context, where JavaScript object creation can invoke arbitrary application logic. The public availability of an exploit and the vendor's lack of response elevate operational risk despite a low base severity rating.

Root Cause

The root cause is improper input validation ([CWE-20]) in the OAuth authorization redirect handler. The redirectToAuthorization function trusts the URL argument and passes attacker-controlled data into a deserialization routine. No allow-listing, schema validation, or origin checks constrain the parameter before it reaches the deserializer. This turns a routine OAuth callback into an object-injection primitive.

Attack Vector

An attacker crafts a malicious MCP server or authorization redirect and induces a Verger user to initiate the OAuth flow against it. When Verger processes the crafted redirect, it invokes redirectToAuthorization with the attacker-supplied URL. The unsafe deserialization step then instantiates attacker-controlled objects within the Verger main process. Refer to the Notion RCE Report and VulDB entry #327007 for technical proof-of-concept details.

No verified exploit code is reproduced here. See the linked advisory for exploitation specifics.

Detection Methods for CVE-2025-11273

Indicators of Compromise

Verger client connections to unfamiliar or untrusted MCP servers, particularly during OAuth authorization flows
Unexpected child processes spawned by the Verger Electron main process following an OAuth redirect
Outbound network requests from Verger to domains outside of previously configured MCP providers
Modifications to Verger configuration files or credential stores immediately after an OAuth redirect event

Detection Strategies

Monitor process telemetry for anomalous behavior originating from the Verger executable, including script interpreters, shells, or LOLBins launched as children of the Electron process
Inspect application logs from the MCP OAuth provider for malformed or oversized URL parameters passed to redirectToAuthorization
Correlate OAuth callback events with subsequent file system or registry changes on endpoints running Verger

Monitoring Recommendations

Enable endpoint detection and response (EDR) telemetry on developer and analyst workstations that run Verger
Log and retain outbound HTTPS destinations from Verger to identify calls to untrusted MCP endpoints
Alert on execution of new binaries dropped into the Verger application data directory

How to Mitigate CVE-2025-11273

Immediate Actions Required

Restrict Verger connections to a known list of trusted MCP servers and block outbound OAuth flows to arbitrary hosts
Uninstall or disable Verger on systems where the client is not operationally required until a patched release is available
Warn users to avoid initiating OAuth authorization against unverified or third-party MCP providers

Patch Information

No vendor patch has been published as of the last NVD modification date (2026-06-17). The vendor was contacted but did not respond to disclosure. Track the VulDB record #327007 and the project repository for updates beyond version 1.2.10.

Workarounds

Configure network egress rules to permit Verger to reach only approved MCP OAuth endpoints
Run Verger inside a sandboxed or containerized profile that limits filesystem and process capabilities
Review and remove any preconfigured MCP providers of unknown provenance from the Verger settings

bash

# Example egress restriction using host firewall (Linux nftables)
# Allow Verger to reach only a trusted MCP OAuth host
sudo nft add rule inet filter output \
  meta skuid $(id -u verger-user) \
  ip daddr != trusted-mcp.example.com \
  tcp dport { 80, 443 } drop