MEDIUM5.3npmGHSA-wx4p-jr66-jfp9· CVE-2026-5602@nor2/heim-mcp vulnerable to command injectionModified: 4/6/2026