Threats affecting pkg:github/nor2-io/heim-mcp

CVE-2026-5602 is an OS command injection vulnerability in Nor2-io heim-mcp versions up to 0.1.3. It affects the registerTools function in the src/tools.ts file within the deploy_heim_application_to_cloud component. Exploitation requires local access and can lead to command injection on the affected system. The vulnerability has been publicly disclosed, and a patch has been released by the vendor to address the issue. The CVSS 4.0 base score is 4.8, indicating medium severity.