EUVD-2026-83747
GHSA-c2f2-x95m-p9vw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach invokable nexus_reauth MCP tool
-
DeliverySupply crafted url with shell metacharacters
-
ExploitInjection reaches child_process.exec
-
ExecutionArbitrary OS commands execute on host
-
ImpactFull host compromise / data theft
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Exploitation requires the nexus_reauth MCP tool to be reachable and invokable, and the attacker to control (directly or indirectly, e.g. via agent-relayed untrusted input) the 'url' argument that src/auth/browser.ts hands to child_process.exec without sanitization. The CVSS 4.0 vector states PR:L, so some level of client/tool-invocation privilege is needed - not fully unauthenticated. Key LIMITING factor: MCP tools commonly run over local stdio, so the stated remote (AV:N) reach depends on whether this server is actually network-exposed; if it is local-only, remote exploitation is not realistic. There is no fixed release (rolling delivery, project has not responded to the report). |
| Impact | Signals conflict sharply. The vendor (VulDB) assigned CVSS 4.0 = 2.1 with vulnerable-system impacts VC:L/VI:L/VA:L, but the described root cause - attacker-controlled 'url' flowing unsanitized into child_process.exec() - is textbook OS command injection yielding arbitrary command execution on the host running the MCP server. Arbitrary exec warrants full VC:H/VI:H/VA:H, not Low; the vendor's 2.1 appears to be a systematic VulDB under-scoring and materially understates real technical impact (my independent 3.1 ≈ 8.8). Countervailing factors keep real-world priority modest: the affected product is an obscure single-author GitHub project (0-Gaurav-0/nexus-mcp), a public POC exists (Xh1Xxhg/public_exp) but there is NO CISA KEV listing and NO EPSS score in the input, so there is no evidence of active or widespread exploitation. The CVSS 4.0 vector claims AV:N, yet MCP tools frequently run over local stdio rather than a network socket - this attack vector should be verified against actual deployment, because if the server is not network-exposed, remote reach is overstated. Net: high technical severity if the tool is reachable and invokable, but low aggregate risk due to near-zero deployment footprint and no exploitation-in-the-wild evidence. |
| Exploit ScenarioDerived | An attacker able to influence the 'url' argument passed to the nexus_reauth MCP tool (e.g., via untrusted content an AI agent relays into the tool call) injects shell metacharacters that child_process.exec executes on the host. A public exploit is available (Xh1Xxhg/public_exp/issues/1), so the injection path is documented and reproducible, granting arbitrary OS command execution in the MCP server's process context. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Command injection in the nexus_reauth MCP tool of 0-Gaurav-0/nexus-mcp lets an attacker who can invoke that tool and control its 'url' argument run arbitrary operating-system commands through the unsanitized child_process.exec call in src/auth/browser.ts. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P), the project was notified via an issue report but has not responded, and because the project uses a rolling release model no fixed version is identified; the CNA scores the issue 2.1 under CVSS 4.0 while our independent assessment rates it 8.8 under CVSS 3.1, reflecting high confidentiality, integrity and availability impact on successful injection. Exploitation requires the nexus_reauth tool to be reachable and invokable and, per the PR:L vector, some low-level tool-invocation privilege rather than fully unauthenticated access, and the practical remote (AV:N) reach depends on whether the MCP server is actually network-exposed instead of local stdio only.
RemediationAI
No vendor-released patch identified at time of analysis: the upstream issue report (https://github.com/0-Gaurav-0/nexus-mcp/issues/1) has received no response, and the project's rolling release model publishes no fixed version, so there is no exact upgrade target to cite. If you can modify the source, the direct fix is to stop using child_process.exec for the 'url' argument and instead use child_process.execFile/spawn or a URL-opening library that takes an argument array and never involves a shell; the trade-off is that shell-specific behaviour (pipes, globbing, chained commands) will no longer work, which is the point. Until then, apply compensating controls: remove network exposure of the MCP server (bind to loopback or run it strictly over local stdio) and block its listening port at the network boundary, understanding that this stops remote reach but not agent-relayed or local abuse; restrict which callers may invoke the nexus_reauth tool and treat its 'url' input as untrusted, validating it against a strict allowlist of schemes and hosts (for example https to known identity providers) and rejecting shell metacharacters, with the caveat that allowlists must be maintained and can break legitimate redirect URLs; and run the MCP server as an unprivileged, sandboxed account or container with a minimal image (no shell utilities where feasible), which limits post-exploitation command execution but does not prevent the injection itself. Because a public exploit exists, prioritise inventory of any exposed nexus-mcp instances over waiting for an upstream fix. Vendor and third-party advisories to monitor are https://vuldb.com/vuln/407959 and the repository/issue links above.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is an MCP (Model Context Protocol) server, nexus-mcp, whose nexus_reauth tool is implemented in src/auth/browser.ts. That code passes a caller-supplied 'url' value into Node.js child_process.exec, which invokes a shell (e.g. /bin/sh -c) and therefore interprets shell metacharacters; because the argument is not neutralized, an injected value can append or substitute commands. The root-cause class is CWE-74 (improper neutralization of special elements in output used by a downstream component), reported here specifically as command injection (the OS-command variant usually tracked as CWE-78): the underlying issue is missing input validation/escaping before the value crosses from application data into a shell command line. No CPE entries were supplied with the record, so exact product identification rests on the GitHub project 0-Gaurav-0/nexus-mcp and the pinned commit aed0026e7ac1f23dc940e46e9fd3a2da6904f914 rather than a vendor CPE string. The MCP context matters for exposure modelling: MCP servers are frequently launched over local stdio by an AI agent, so the AV:N rating in the vector presumes a deployment where the server is reachable over the network or where untrusted input is relayed into the tool by an agent.
Know when TypeScript gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Unsanitized url reaching child_process.exec is arbitrary OS command execution, so C/I/A:H; PR:L reflects the privilege needed to invoke the MCP tool; AV:N per 'remote' but MCP transport should be verified.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd3a2da6904f914. Affected by this issue is the function child_process.exec of the file src/auth/browser.ts of the component nexus_reauth MCP tool. The manipulation of the argument url results in command injection. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in TypeScript
View allJoplin Server instances prior to 3.7.2 expose an SSO login-code redemption endpoint (GET /api/login_with_code/:id) that
Cross-tenant authorization bypass in TinaCMS self-hosted deployments allows any holder of a legitimate TinaCloud account
Authenticated clients on deepstream.io 10.1.0 can bypass record-write authorization and modify arbitrary protected recor
OS command injection in zosmaai's pi-llm-wiki through 0.11.7 lets an attacker who can invoke the wiki_capture_source MCP
Path traversal in decap-server's local proxy containment guard allows an unauthenticated attacker to read, write, or del
A remote, unauthenticated denial-of-service condition in the NestJS (Nest) microservices framework lets an attacker cras
Fee-sponsoring servers built on mppx before 0.8.2 can be induced by any client with access to the sponsorship endpoint t
Code escaping sandbox in the PraisonAI npm package's built-in codeMode tool (praisonai 1.4.0 through 1.7.1) lets anyone
Unauthenticated passkey enrollment in OpenReception appointment-booking software prior to 1.1.1 lets remote attackers in
A credential-isolation flaw in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker who controls or can pred
Remote code execution affects Univer v1.0.0-alpha.2 through its Uniscript feature: the UniscriptExecutionService.execute
Dokploy instances running versions prior to 0.29.13 disclose stored Git provider secrets - GitHub App private keys, OAut
Exploit-DB