CRITICALnpmGHSA-mwr6-3gp8-9jmj· CVE-2026-22785orval MCP client is vulnerable to a code injection attack.Modified: 2/3/2026