Description

A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd3a2da6904f914. Affected by this issue is the function child_process.exec of the file src/auth/browser.ts of the component nexus_reauth MCP tool. The manipulation of the argument url results in command injection. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-20T14:17:00.780Z",
  "pubdate": "2026-09-20T14:17:00.780Z",
  "executiveSummary": "A critical command injection vulnerability exists within the nexus_reauth MCP tool, specifically impacting the 0-Gaurav-0 nexus-mcp repository at commit aed0026e7ac1f23dc940e46e9fd3a2da6904f914.\nThe vulnerability originates from the insecure handling of user-supplied input within the child_process.exec function located in src/auth/browser.ts.\nThis flaw allows a remote, unauthenticated attacker to inject arbitrary shell commands, which are subsequently executed with the privileges of the application process.\nThe impact includes full remote code execution (RCE), potentially leading to complete system compromise, data exfiltration, or lateral movement within the hosting environment.\nGiven that the project utilizes a rolling release model and the vulnerability is public, the risk is severe. The maintainers have been notified but have not provided a resolution, necessitating immediate defensive action by users.",
  "technicalDetails": "The vulnerability resides in the src/auth/browser.ts file of the nexus-mcp component, specifically within the logic handling the 'url' parameter for re-authentication processes.\nThe root cause is the usage of the Node.js 'child_process.exec' function, which spawns a shell to execute command strings. By failing to adequately sanitize or escape the 'url' argument, the application allows an attacker to break out of the intended command context by injecting shell metacharacters such as ';', '&&', or '|'.\nWhen the 'url' parameter is processed, it is directly concatenated into a string executed by the system shell. An attacker can craft a malicious 'url' string containing arbitrary command sequences. Upon invocation of the function, the shell interprets the injected commands, executing them immediately.\nThis is a classic command injection vulnerability where input validation is absent at the function boundary. The attack flow is as follows: 1) The attacker identifies an input vector that triggers the nexus_reauth functionality. 2) The attacker submits a specially crafted 'url' argument containing malicious system commands (e.g., 'http://target; rm -rf /;'). 3) The application, failing to validate the input, passes this string directly to 'child_process.exec'. 4) The operating system executes the injected commands with the privilege level of the underlying Node.js process.\nThe vulnerability is remotely exploitable without authentication, as the affected function can be triggered via incoming MCP tool requests. The exploitation does not require advanced privileges, as the execution occurs within the context of the running application. The post-exploitation impact is severe, enabling the attacker to gain persistent access to the server, access environment variables, read sensitive authentication tokens, or interact with the local filesystem and network infrastructure."
}